Vulnerability-scan alerts on images kept firing. The root cause was that “fixable” is a CVE-database claim, not a claim about what is actually pullable.
What the count claims
A “fixable” count reports what the CVE database says. It does not report what the registry currently serves, so it cannot say whether a re-pull would bring anything new.
The check
Compare each image’s scanned digest with its registry’s current digest, here on sixteen of the worst offenders. Fourteen came back identical, so there was nothing to gain by re-pulling them.