Suppress vulnerabilities applying Kubernetes context to scans

VEX8S is a tool that produces VEX (Vulnerability Exploitability eXchange) documents by correlating container vulnerability reports with Kubernetes workload settings to decide which CVEs are actually exploitable. It classifies each CVE into one or more exploitation categories - using both CWE data and an embedded ONNX ML model or an optional Gemini LLM - and maps those categories to specific Kubernetes securityContext settings that can block or mitigate exploitation. By parsing Kubernetes manifests and combining manifest-based security checks with scanner output, VEX8S flags vulnerabilities as mitigated when cluster configuration prevents their exploitation, then generates VEX documents that scanners like trivy and grype can consume to suppress those findings.

The tool supports passive mode (recommended) where it ingests preexisting trivy or grype reports, and active mode where it runs scans itself using those engines, then outputs a VEX file that re-scans can use to show suppressed vulnerabilities. It bundles an offline classifier for air-gapped use and an optional Gemini-based classifier requiring an API key. Installation is via downloadable binaries or make build, and examples and user-guide details cover classifier selection, CLI flags, and workflows. The project is experimental and inspired by vexllm.