fix: Fixed vuln score

server/internal/vulnsched/sched.go

@@ -181,13 +181,17 @@ func (s *scheduler) scanPending(ctx context.Context) {
 	// channel muted, and either way the alerts stop being read.
 	newly := map[string][]models.VulnFinding{}
 
+	// One metadata cache for the whole tick: a CVE affects every host running
+	// the package, and the lookup is the same read each time.
+	meta := vulndb.NewMetaCache(s.store)
+
 	for _, sp := range pending {
 		if ctx.Err() != nil {
 			// Leadership lost. scan_pending is still set, so the next leader
 			// picks these up — which is why it lives on the document.
 			return
 		}
-		opened := s.scanOne(ctx, sp)
+		opened := s.scanOne(ctx, sp, meta)
 		newly[sp.InstanceID] = append(newly[sp.InstanceID], opened...)
 	}
 
@@ -203,7 +207,7 @@ func (s *scheduler) scanPending(ctx context.Context) {
 	)
 }
 
-func (s *scheduler) scanOne(ctx context.Context, sp models.ServerPackages) []models.VulnFinding {
+func (s *scheduler) scanOne(ctx context.Context, sp models.ServerPackages, meta *vulndb.MetaCache) []models.VulnFinding {
 	now := time.Now()
 	log.Printf("vulnsched: scanning server %s (instance %s, os %s %s, %d packages)",
 		sp.ServerID, sp.InstanceID, sp.OS.Family, sp.OS.VersionID, len(sp.Packages))
@@ -226,6 +230,11 @@ func (s *scheduler) scanOne(ctx context.Context, sp models.ServerPackages) []mod
 		return nil
 	}
 
+	// Severity for the Debian-family buckets lives on the CVE, not the
+	// advisory. Without this every finding is stored as "unknown", which also
+	// silences every alert rule with a minimum severity.
+	meta.Enrich(results)
+
 	existing, err := services.ListFindings(ctx, sp.InstanceID, sp.ServerID)
 	if err != nil {
 		log.Printf("vulnsched: list findings %s: %v", sp.ServerID, err)