bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

ndaal_public_SBOM_Auditor

ndaal SBOM Auditor A single-binary, offline web application to investigate SBOM Software Bill of Materials files. Upload an SBOM or import a folder of them, analyse each with an ensemble of independent tools, review the normalised findings in one local UI, and export the result in eight formats. ...

syft

Syft 一个用于从容器镜像和文件系统生成软件物料清单（SBOM）的 CLI 工具和 Go 库。与Grype 等扫描器配合使用时，在漏洞检测方面表现出色。 特性 为容器镜像 、文件系统 、归档文件 生成 SBOM（有关受支持的扫描目标完整列表，请参阅文档） 支持数十种打包生态系统（例如 Alpine（apk）、Debian（dpkg）、RPM、Go、Python、Java、JavaScript、Ruby、Rust、PHP、.NET 以及更多） 支持 OCI、Docker、Singularity 以及更多镜像格式 与 Grype 无缝协作，用于漏洞扫描 多种输出格式（CycloneDX...

CLEANSTART-2026-LL04438 Security fix for CVE-2026-33762 applied in: argo-cd 3.2.7-r2, argo-cd 3.3.5-r2, argo-cd-fips 3.1.14-r0, argo-cd-fips 3.2.9-r0, external-secrets-fips 0.17.0-r2, flux-image-automation-controller-fips 4.0.1-r0, gitlab-runner 18.11.1-r0, gptscript 0.9.8-r0, grafana-alloy 1.13.1-r1, grafana-alloy 1.14.0-r1, grafana-alloy 1.14.1-r1, grafana-alloy 1.14.2-r0, grafana-alloy 1.15.0-r0, grafana-alloy 1.16.0-r0, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.16.0-r0, kubevela 1.10.8-r0, pulumi-kubernetes-operator 2.7.0-r0, syft 1.42.4-r0, timoni 0.25.2-r0

CVE-2026-33762 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.52.0-0.1.hum1 aarch64, x8664 syft-1.52.0-0.1.hum1.src src...

GO-2026-6444 vulnerabilities

Vulnerabilities for packages: manifest-tool, newrelic-infrastructure-agent, rancher-agent, xeol, helm-set-status, kaniko, syft, k9s, datadog-agent, steampipe, grype, tigera-operator, docker-cli-buildx, helm-mapkubeapis, nerdctl, buildkitd, kubevela, helm, eksctl, dagger, k8ssandra-client,...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.51.1-0.2.hum1 aarch64, x8664 syft-1.51.1-0.2.hum1.src src Security Fixes: syft: CVE-2026-88922...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.51.1-0.1.hum1 aarch64, x8664 syft-1.51.1-0.1.hum1.src src...

GO-2024-2490 vulnerabilities

Vulnerabilities for packages: zarf, k9s, syft, grype, wolfictl, kubescape...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, grype-fips, conftest, packer-fips, snyk-cli, tflint, syft-fips, crossplane-provider-terraform, tfsec, syft, packer, terragrunt-fips, kubescape, trivy, trivy-fips, terraform-fips, k9s-fips, zarf, k9s, cloudbeat, crossplane-provider-terraform-fip...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: gotenberg, grype-fips, syft-fips, syft, undock, kubescape, filebrowser, chezmoi, k9s-fips, zarf, gitleaks, k9s, wolfictl, grype-db, mattermost, gptscript, trufflehog, trufflehog-fips, nuclei, kots, cg, mattermost-fips, grype, chainctl...

GO-2024-2491 vulnerabilities

Vulnerabilities for packages: k3d, k3s, syft, cadvisor, skaffold, buildkitd, docker, kubescape, trivy, newrelic-infrastructure-agent, zarf, k9s, kaniko, nerdctl, wolfictl, ctop, zot, skopeo, podman, kots, runc, kubernetes, grype...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, cadvisor-fips, buildah, k3s, neuvector, syft, cadvisor, docker, gosu, neuvector-scanner-fips, ctop, opentelemetry-collector-contrib-fips, grafana-alloy, eks-distro-fips, grafana-alloy-fips, kubernetes-fips, opentelemetry-collector-contrib,...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: buf, docker-compose, cri-tools, policy-controller-fips, k3d, melange, kaniko, policy-controller, harbor-scanner-trivy, syft, harbor-scanner-trivy-fips, dagger, neuvector-scanner, grype, wolfictl, helm-push...

GO-2025-3528 vulnerabilities

Vulnerabilities for packages: k8ssandra-client-fips, flux-source-controller-fips, grype-fips, rancher-fleet-fips, spegel, docker-cli-buildx, cluster-api-helm-controller, flux-source-controller, consul-k8s, cert-manager-cmctl-fips, k3s, k8ssandra-client, neuvector, helm-fips, syft, beats,...

GO-2026-5758 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, grype-fips, k3s, consul-k8s, k8ssandra-client, kube-mgmt, neuvector, syft, skaffold, rancher-agent, kubescape, google-osconfig-agent, spegel-fips, tigera-operator-fips, kaniko, cloudbeat, docker-compose-fips, chartmuseum, crossplane,...

GO-2024-2490 vulnerabilities

Vulnerabilities for packages: zarf, grype, syft, kubescape, k9s, wolfictl...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: task, xeol, tfsec, syft, k9s, steampipe, grype, opentofu, terraform, kots, terragrunt, kubescape, zot, trivy, snyk-cli, trivy-operator, conftest, zarf, tflint, wolfictl...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: gptscript, zarf, kots, grype, chezmoi, undock, nuclei, syft, kubescape, k9s, trufflehog, filebrowser, gitleaks, wolfictl...

GO-2025-4098 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, xeol, undock, checksec, kubernetes, envoy-gateway, nvidia-container-toolkit, syft, k9s, grype, k8s-device-plugin, podman, nerdctl, kots, ctop, mesosphere-vsphere-csi, dagger, kubescape, kubernetes-csi-driver-nfs, zot, falco-no-driver,...