Grype — Container Vulnerability Scanner

Overview

Grype (github.com/anchore/grype, latest release v0.120.0 at the time of writing) matches the packages it finds in an image, directory or SBOM against a local vulnerability database built from NVD, GitHub advisories and distro security feeds. It covers OS packages (Alpine, Debian, Ubuntu, RHEL, Amazon Linux, SLES and others) and language packages (Java, JavaScript, Python, Go, Ruby, PHP, .NET, Rust). Findings carry EPSS, KEV and risk scores, and OpenVEX documents can filter them. Its sibling Syft produces the SBOMs.

Instructions

Install

# macOS / Linux with Homebrew
brew tap anchore/grype && brew install grype

# Other package managers: winget install Anchore.Grype, scoop install main/grype,
# sudo port install grype, snap install grype, sudo pacman -S grype-bin