non blogspam version: <a href="https://www.rezilion.com/blog/rezilion-research-finds-hundreds-of-vulnerabilities-hiding-in-containers/" rel="nofollow">https://www.rezilion.com/blog/rezilion-research-finds-hundre...</a> with the tl;dr of "people use curl to install software, some scanners only consult dpkg-query, onoz"