public static GrypeReport GrypeReadJson(this ICakeContext context, FilePath path)

var report = GrypeReadJson("./artifacts/grype.json");
var blocking = report.Matches.Where(m =>
       m.IsKnownExploited
    || m.MaxEpssScore >= 0.5
    || (m.Severity >= GrypeSeverity.Critical && m.Vulnerability.Fix.State == GrypeFixState.Fixed)
    || m.Risk >= 50).ToList();
if (blocking.Count > 0)
{
    throw new CakeException($"{blocking.Count} blocking vulnerabilities");
}

Unknown means "not assessed yet" (for example a reserved CVE). Such matches have risk 0 and no EPSS, KEV or CVSS data, so severity, risk and EPSS thresholds skip them; check for GrypeSeverity.Unknown explicitly if they should block a build.