Skip to content
THREATWIRE

Grype

Vulnerability scanner for images, file systems and SBOMs

Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

Open sourceApache-2.0
Alternative toSnykSonatype Lifecycle
View repository Docs
Homepage of Grype
Official repository page, captured by ThreatWire.

What Grype does

Grype catalogues the packages in a container image or directory (using Syft under the hood) and matches them against its vulnerability database, built from sources such as the NVD, GitHub advisories and Linux distribution feeds. It can also scan an existing SBOM.

Results can be filtered by severity, fixed state or ignore rules and exported in several formats, which makes it suitable as a CI gate.

Key features

  • Scans images, directories, archives and SBOMs
  • OS packages and many language ecosystems
  • Fail builds on a severity threshold
  • Ignore rules and VEX support
  • JSON, SARIF, CycloneDX and table output

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of Grype itself

1 published advisory for Grype in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.

  • GHSA-6gxw-85q2-q646CVE-2025-65965high2025-11-24

    Credential disclosure vulnerability in Grype JSON output

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Dependencies and SBOM (SCA)Container and Kubernetes security#vulnerability-scanner#containers#sbom#go#security#vulnerability#docker#golang

Related tools

  • Syft

    SBOM generator for images and file systems

    CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.

    Stars
    9.7k
    Forks
    1k
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSonatype LifecycleSnyk

  • OSV-Scanner

    Dependency scanner backed by the OSV database

    Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.

    Stars
    11k
    Forks
    816
    Last commit
    7 days ago
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/grype