Grype

Grype is an open-source vulnerability scanner developed by Anchore that scans container images, filesystems, and Software Bill of Materials (SBOMs) for known security vulnerabilities. Scan Targets: - Container images (Docker, OCI, and Singularity image formats) - Local filesystems and directories - SBOMs (including those generated by Syft) OS Package Ecosystem Support: - Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon Linux, and others Language-Specific Package Support: - Ruby, Java, JavaScript, Python, .NET, Go, PHP, Rust, and others Grype cross-references discovered packages against vulnerability databases to identify known CVEs and security issues. It supports threat and risk prioritization using EPSS (Exploit Prediction Scoring System), KEV (Known Exploited Vulnerabilities), and risk scoring to help users understand and prioritize remediation efforts. The tool also supports OpenVEX, which allows users to filter and augment scan results based on Vulnerability Exploitability eXchange data. Grype can accept SBOM input directly, either as a file or via stdin pipe, enabling faster vulnerability detection workflows. It is installable via curl, Homebrew, Docker, Chocolatey, MacPorts, and other package managers. Grype is released under the Apache-2.0 License and is sponsored by Anchore. Commercial support options are available through Anchore.