[silverwind]

Govulncheck is good, but not without false-positives. Sometimes it raises "unfixable" vulnerabilities and there's still no way to exclude vulnerabilties by CVE number.

[ImJasonH]

I haven't experienced that (that I know of), do you have an example handy?