A CVE just hit your base image. Your scanner won't tell you which repos to fix.

A scanner finds the vulnerable base image — not the repos you patch. Why base-image CVE remediation is a cross-repo source problem, and how to get the list.