[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Stackland](../../index.md) > [Step-by-step guides](../index.md) > Policies > Viewing vulnerability reports

# Viewing vulnerability reports

Trivy Operator scans custom application images and saves the results to `VulnerabilityReport` resources.

{% note warning %}

These reports are informative. Presence of critical or high vulnerabilities does not block creating, starting up, and restarting pods.

{% endnote %}

## Using the CLI {#cli}

1. Get a list of reports for all namespaces:

   ```bash
   kubectl get vulnerabilityreports.aquasecurity.github.io --all-namespaces
   ```

1. View the report in question:

   ```bash
   kubectl get vulnerabilityreport <report_name> \
     --namespace <namespace> \
     --output yaml
   ```

   The main fields include:

   * `report.registry.server`: Scanned image registry.
   * `report.artifact`: Repository, digest, tag, and MIME type of the scanned image.
   * `report.scanner`: Trivy version that created the report.
   * `report.summary`: Number of detected vulnerabilities by severity score.
   * `report.vulnerabilities`: Vulnerability ID, identified and fixed package version, score, and link to a description.

1. If needed, get standard Policy Manager reports created by the adapter for `VulnerabilityReport` with detected vulnerabilities:

   ```bash
   kubectl get policyreports.wgpolicyk8s.io --all-namespaces \
     --selector trivy-operator.source=VulnerabilityReport
   ```

## Using the management console {#console}

Critical and high vulnerabilities are shown together with other Policy Manager reports. A CVE name is shown as text: it is not a Kyverno policy, and you cannot create `ClusterPolicyMute` for such a row.

## If you did not get a report {#if-nothing-worked}

Check the following:

* `PolicyManagerConfig.spec.enabled` and `PolicyManagerConfig.spec.settings.trivy.enabled` are not set to `false`.
* The namespace is not included in the exclusion list.
* The initial load can upload an image with the specified `ServiceAccount` and `imagePullSecrets`.
* The scan task in the namespace is complete `stackland-policy-manager`.
* The scanner image and Trivy Server successfully received the Java DB and main vulnerability DB included in the distribution, or both parameters of the relevant external mirror.