Thanks for the response. Does that mean that the container is not susceptible to these vulnerabilities, or that you have assessed the vulnerabilities, but that this assessment status has not been replicated? Based on the package list (https://proget.inedo.com/containers/tags/ProductImages/inedo/proget/25.0.10-ci.9/packages), and the vulnerability details, it would appear that most may be relevant, at least from a package content perspective.

My organization is in the process of evaluating ProGet, which we would be looking to run as a Linux container. As part of the security evaluation we noticed that all of the vulnerabilities of the latest container version (https://proget.inedo.com/containers/tags/ProductImages/inedo/proget/25.0.10-ci.9/vulnerabilities at the time of writing), as well as earlier container versions listed, are labelled as "? Unassessed". Is there a reason for this?