grype

Vulnerability Scanning

A vulnerability scanner for container images, filesystems, and SBOMs.

Go Latest v0.113.0 · 10h ago Security brief →

Features

Scan container images, filesystems, and SBOMs for known vulnerabilities
Supports major OS package ecosystems (Alpine, Debian, Ubuntu, RHEL, etc.)
Supports language‑specific packages (Ruby, Java, JavaScript, Python, .NET, Go, PHP, Rust)
Handles Docker, OCI, and Singularity image formats
Provides threat & risk prioritization with EPSS, KEV, and custom scoring

View all 13 releases →

Monitor

v0.113.0 New feature 10h

Crypto / TLS

Ubuntu 26.04 + Hummingbird filter + TLS/HTTP warnings

Open

v0.112.0 New feature 1mo

Notable features

Full changelog

Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow]

v0.111.1 Bug fix 1mo

Fixed vulnerability relationship matching, SARIF output helpURI, and Debian component recognition.

Full changelog

apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow]
compare mismatched package / db versions [#3372 @kzantow]
Grype doesn't recognize debian component when "group" : "debian" is specified [#2967]
HelpURI missing information in SARIF output [#2874 #3351 @will-bates11]

v0.111.0 New feature 1mo

Notable features