Is it possible to extract vulnerabilities from Azure Container Registry based on image name and tag?

Azure Container Registry integrates with Qualys to provide vulnerability insights of images. These vulnerabilities are viewable in the portal. When looking at a vulnerability, it references the affected image via the digest (rather than the tag). I've developed a script that does the following:

• Run an Azure Resource Graph query to return vulnerabilities and digests
• Creates a custom PS object that adds various information to an array (for each vulnerability) such as severity, status, image name, digest, cve, etc
• Uses Get-AzContainerRegistryRepository to extract all image names to an array, then loops through that array and runs Get-AzContainerRegistryTag, stores all tags and digests in an array
• Calls a custom function that compares the digest from the previous step and the digest from the first step, and if they match then add a tag object to the custom PS object (from step 2)
• Export CSV of the custom PS object.

Some vulnerabilities now have the tag and some don't.

The issue is that some vulnerabilities are for the layers within the tag, e.g. you could have alpine:latest but that has it's own digest even though the tag also contains two layers for architectures amd64 & arm64. So a vulnerability can exist for alpine:latest, but, if the vulnerability is for a layer within the image, then it won't get included in the export because there's no way of linking a child layer within an image to it's parent (which does have a tag).

I'm just wondering if anyone has been able to code something that basically does the following:

• Call Azure Container Registry with an image name and tag
• Export vulnerabilities for that image name and tag