syft

Syft 一个用于从容器镜像和文件系统生成软件物料清单（SBOM）的 CLI 工具和 Go 库。与Grype 等扫描器配合使用时，在漏洞检测方面表现出色。 特性 为容器镜像 、文件系统 、归档文件 生成 SBOM（有关受支持的扫描目标完整列表，请参阅文档） 支持数十种打包生态系统（例如 Alpine（apk）、Debian（dpkg）、RPM、Go、Python、Java、JavaScript、Ruby、Rust、PHP、.NET 以及更多） 支持 OCI、Docker、Singularity 以及更多镜像格式 与 Grype 无缝协作，用于漏洞扫描 多种输出格式（CycloneDX...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

GO-2024-2490 vulnerabilities

Vulnerabilities for packages: grype, k9s, kubescape, syft, wolfictl, zarf...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: packer, terraform-fips, tfsec, terragrunt-fips, trivy, kubescape, task-fips, terraform, syft, kots, cloudbeat, crossplane-provider-terraform, tflint-fips, grype-fips, chainctl, k9s-fips, cg, kubescape-server-fips, chainctl-fips, crossplane-provider-terraform-fips,...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: undock, kubescape, syft, kots, chezmoi, grype-fips, mattermost, chainctl, k9s-fips, cg, filebrowser, grype, mattermost-fips, syft-fips, trufflehog, wolfictl, zarf, trufflehog-fips, nuclei, gotenberg, gptscript, k9s, grype-db, gitleaks...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, node-feature-discovery, syft, cluster-autoscaler-fips, docker, neuvector-scanner, kubernetes-fips, cadvisor-fips, grype, ctop, grafana-alloy-fips, eks-distro-fips, k3s, opentelemetry-collector-contrib-fips, podman, kubernetes, neuvector-fips,...

GO-2024-2491 vulnerabilities

Vulnerabilities for packages: trivy, kubescape, k3d, syft, kots, docker, grype, ctop, k3s, nerdctl, podman, kubernetes, kaniko, newrelic-infrastructure-agent, skopeo, zot, wolfictl, zarf, skaffold, runc, buildkitd, k9s, cadvisor...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: docker-compose, kaniko, harbor-scanner-trivy, grype, cri-tools, dagger, k3d, policy-controller-fips, harbor-scanner-trivy-fips, melange, buf, syft, wolfictl, policy-controller, docker, helm-push, neuvector-scanner...

GO-2025-3528 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, beats-fips, cilium-cli, trivy, dagger, kubescape, helm-fips, syft, flux-source-controller, consul-k8s, kots, cluster-api-helm-controller-fips, docker-cli-buildx, kubevela, buildkitd-fips, spegel, docker, cert-manager-cmctl,...

GO-2026-5758 vulnerabilities

Vulnerabilities for packages: amazon-ecs-agent-fips, tigera-operator, helm-fips, crossplane-fips, kots, cloudbeat, spegel, buildkitd-fips, headlamp, neuvector-scanner, kube-mgmt, linkerd2, spegel-fips, chainctl-fips, grype, zarf-fips, ctop, kube-arangodb-fips, k3s, syft-fips,...

GO-2024-2490 vulnerabilities

Vulnerabilities for packages: wolfictl, k9s, kubescape, syft, grype, zarf...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: steampipe, kots, syft, task, grype, opentofu, wolfictl, kubescape, conftest, tflint, zot, snyk-cli, trivy, terraform, xeol, k9s, tfsec, trivy-operator, zarf, terragrunt...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: wolfictl, trufflehog, kots, k9s, kubescape, syft, gitleaks, filebrowser, grype, nuclei, gptscript, zarf, chezmoi, undock...

GO-2025-4098 vulnerabilities

Vulnerabilities for packages: podman, nvidia-container-toolkit, kots, buildah, spegel, syft, grype, containerd, undock, kubernetes-csi-driver-nfs, node-feature-discovery, wolfictl, skaffold, kubescape, zot, k8s-device-plugin, grafana-alloy, skopeo, trivy, k3s, nerdctl, kubernetes, xeol, dagger,...

GO-2024-2491 vulnerabilities

Vulnerabilities for packages: podman, kots, k3d, syft, grype, buildkitd, wolfictl, skaffold, kubescape, zot, skopeo, trivy, nerdctl, k3s, kubernetes, k9s, kaniko, docker, ctop, cadvisor, runc, newrelic-infrastructure-agent, zarf...

GO-2025-3528 vulnerabilities

Vulnerabilities for packages: kots, docker-compose, helm-operator, spegel, docker-cli-buildx, syft, grype, buildkitd, melange, eksctl, opa, cluster-api-helm-controller, wolfictl, opa-envoy, skaffold, cert-manager-cmctl, kubescape, linkerd2, rancher-fleet, zot, k8ssandra-client, cilium-cli,...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: kubernetes, podman, opentelemetry-collector-contrib, ctop, cadvisor, buildah, neuvector-scanner, runc, syft, grype, k8s-device-plugin, grafana-alloy, docker, k3s...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy, cri-tools, policy-controller, wolfictl, buf, docker-compose, dagger, neuvector-scanner, helm-push, k3d, syft, grype, melange, kaniko, docker...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: kots, crossplane, gitea, timoni, flux-image-automation-controller, syft, task, flux, grype, melange, scorecard, pulumi, wolfictl, pulumi-language-java, skaffold, kubescape, argo-events, zot, snyk-cli, chezmoi, grafana-alloy, trivy, bom, pulumi-language-yaml, dagger,...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, buf, buildah, docker-compose, falcoctl, docker-cli-buildx, syft, grype, buildkitd, melange, wolfictl, openfga, zot, trivy, nerdctl, spire-server, trufflehog, splunk-otel-collector, dagger, k9s, kargo, goreleaser, aws-otel-collector, t...