Security teams rarely lack data. They lack time. When a new advisory lands, security teams spend the first hours on questions their tooling should already answer. Where does this package run? Is this finding real? Did its severity change since we triaged it? Is this AI model approved? Every manual search adds delay, and every false positive buries the findings that matter.

We are announcing Anchore Enterprise v6.3, built to cut the noise and wasted effort between “a vulnerability exists” and “we know what to fix.” This release adds quick package search for issues without a published vulnerability, Ubuntu ESM support that removes false positives from Ubuntu packages past their standard end-of-life window, notifications when a known vulnerability worsens over time, and policy gating for AI models.

Find It Sooner: Quick Package Search to Find Affected Packages Before a CVE Exists

Sometimes a package has a known security issue before the vulnerability has been researched and published. Other times, the nature of the exploit is such that a CVE never gets assigned. In such cases, a vulnerability search is not very useful, as it will not produce any matches, and teams are left guessing whether they use the impacted package across their applications.

On March 30, 2026, StepSecurity identified two malicious versions of Axios, an extremely popular JavaScript HTTP client library with tens of millions of weekly downloads. The maintainer’s account was hijacked and used to publish poisoned releases (1.14.1 and 0.30.4) to npm. The attacker injected a hidden dependency, [email protected],  that drops a cross-platform remote access trojan (RAT). The malicious versions were live for about 3 hours before being removed, but a CVE was never published since the security issue was not a flaw or bug in the software’s actual source code.

In this case, the question that mattered was not “which CVE is this?” It was “where do we run axios 1.14.1 or 0.30.4, and where does plain-crypto-js appear?”

Anchore Enterprise v6.1 introduced a Quick Vulnerability Search to assess blast radius from a published vulnerability. This release extends that with a Quick Package Search to easily identify instances of a component of interest. The search can be executed using a package name and optionally a version, or by supplying a Package URL (PURL):

  • Name only or partial name: Find every app version that contains the package, whatever the version.
  • Name and version: Narrow the results to the versions you are told to worry about.
  • PURL: Match the exact package and ecosystem, so lookalike names in other ecosystems don’t add noise.

Teams can start mitigating their risk or remediating the impacted package immediately by identifying the affected application versions while the vulnerability record catches up, or if one never gets published.

Stop Chasing Noise: Ubuntu ESM Support

Legacy Ubuntu releases that no longer receive standard security updates can stay protected through Ubuntu Expanded Security Maintenance (ESM), which extends security patches for certain packages. The problem for scanners is that those fixes are not in the standard Ubuntu vulnerability data. A package that ESM has already patched still gets flagged as vulnerable, and someone has to investigate and dismiss each false positive.

Anchore Enterprise v6.3 eliminates false positives on Ubuntu ESM images. It recognizes ESM images and evaluates them against a separate vulnerability data feed that covers ESM fixes, so findings reflect what is actually patched. This builds on the existing Red Hat Extended Update Support (EUS) to cover the Ubuntu ecosystem.

Know When It Gets Worse: Alerts When a Vulnerability Gets Worse

A vulnerability that was low priority when your team triaged it can become urgent later. Its score goes up, its severity is raised, or it is added to the CISA Known Exploited Vulnerabilities (KEV) catalog. An alert that fires once at first detection and never again misses exactly these changes. Anchore Enterprise v6.3 closes this blind spot with detailed notifications that explain each vulnerability metadata change (CVSS score or severity, EPSS, or KEV). The nature and significance of a vulnerability changes over time, and alerting should follow it. Teams can route the right alert to the right owner when a finding gets worse, instead of rechecking old findings on a schedule.

Govern What You Ship: Gate AI Models in App Versions in Your Pipeline

Anchore Enterprise v6.2 made AI models visible by detecting GGUF files and Docker Models in container images. Seeing a model is only the first step. Security teams also need to know which application versions contain one, and to decide what happens when it shows up. Anchore Enterprise v6.3 does both:

  • AI models in app versions: Discovered AI models (GGUF and Docker Models) are reported as packages in application versions.
  • Packages policy gate for AI models: Security teams can gate on a discovered AI model in their analyzed applications, and choose how the gate responds.

The gate has two outcomes:

  • Fail: A hard stop for organizations that do not allow unvetted models in production.
  • Warn: The pipeline continues, and the discovered model is flagged as one that needs to go through a parallel vetting process.

The warn option matters as much as the fail option. Teams can adopt AI model governance without choosing between blocking developers and ignoring the models entirely, and vetting runs alongside delivery instead of in front of it.

Less Noise, Less Effort

Anchore Enterprise v6.3 keeps the focus on shortening the path from a security signal to a decision.

  • Earlier visibility: Quick Package Search covers the gap before a vulnerability is published, or if one is never published.
  • Fewer false positives: Ubuntu ESM support evaluates image scans against ESM fix data.
  • Fewer surprises: Metadata change notifications follow a vulnerability as it gets worse.
  • Governed AI: AI models are reported in app versions and can be gated with fail or warn outcomes.

For additional information, please visit our release documents or contact our team for an in-depth demo.