An image scan suddenly reports a dozen new Critical CVEs on an image that hasn't changed in months

The Dockerfile and source code are unchanged, but a scheduled re-scan in CI now fails. Explain why and the correct response. Expected reasoning: the image's pinned base image and dependencies haven't changed, but the vulnerability database has — new CVEs are continuously discovered and published against existing software versions. The correct response is not to disable scanning, but to evaluate each finding (patch availability, exploitability, exposure), upgrade the affected base image/dependency where a fix exists, and document any accepted-risk exceptions with an expiry date for re-review.