Grype

Name: Grype
Author: anchore

by anchoreGo

Vulnerability scanner for container images and filesystems.

Toolexperimental

Maturity: experimental because latest release v0.116.1 is pre 1.0. Derived from release and commit history, not a rating.

Stars: 13k
Forks: 849
Downloads / mo: —
Last commit: 2026-07-31
License: Apache-2.0
Open issues: 386

Market and trust evidence

Edition not yet matched

No exact skills.sh identity match is available for this repository. Repository adoption and freshness remain visible above; install momentum is not inferred.

Trust analysis is a screening signal, not a security warranty. Read the ranking and trust methodology.

In practice

Written by AI from this repository’s README · high confidence

Knowing which known vulnerabilities ship inside an image or project before it reaches production.

Use it when

When scanning images, directories or SBOMs in a pipeline and you want EPSS and KEV based prioritization.

Not the right pick when

It reports known vulnerabilities from package data, so it is neither a code analyzer nor a secrets scanner.

Capabilities

Scans container images, filesystems and SBOMs
Supports major OS package ecosystems
Supports language specific packages across many ecosystems
Handles Docker, OCI and Singularity image formats
EPSS, KEV and risk scoring prioritization
OpenVEX support for filtering and augmenting results

Cost: Free and open source

Compare Repository ↗

Video walkthroughs

Grype open source vulnerability scanner demo

Anchore · 11K views · ≈Aug 2021

Trivy EP08 |Trivy Alternatives Explained 🔍 | Trivy vs Grype vs Docker Scout

Shubham gour · 476 views · ≈Jan 2026

Tool Review - Anchore Tools [ Part 3 ] | GitHub Actions for Syft and Grype

LearnSBOM · 1K views · ≈Aug 2023

Third-party YouTube uploads matched to this tool by title, channel and repository name on 2026-08-03. Not made, reviewed or endorsed by SkillPilot. View counts and publish months are as of the match date and the month is approximate. Nothing loads from YouTube until you press play.

What the repository ships

Has testsDocker imageSecurity policyCI configured

Detected from the actual files in the repository root.

Latest release v0.116.1

Published 2026-07-28

Bug Fixes

Ensure channel parsing is consistent PR [#3603 @wagoodman]
Scope Go GHSA twins by shared CVE PR [#3592 @wagoodman]
do not cache a comparator that failed to build PR [#3567 @arpitjain099]
Add fix date to rhel minor records created from rhsa PR [#3585 @wagoodman]
grype reporting CVE-64091 as critical - redhat says it is not affected Issue [#3591]
panic: index out of range in distro.parseVersion for VERSION_ID=v Issue [#3588] PR [#3589 @matiasinsaurralde]
False Positive: GO-2026-5932 Issue [#3573]

Dependencies

30 dependency changes (30 updated). 1 vulnerability remediated.

🟢 Remediated (1)

GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

<summary>Updated (30 packages)</summary>

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
github.com/anchore/stereoscope v0.2.2 → v0.3.0
github.com/anchore/syft v1.48.0 → v1.50.0
github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
github.com/moby/moby/api v1.54.2 → v1.55.0
github.com/moby/moby/client v0.4.1 → v0.5.0
github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
golang.org/x/crypto v0.53.0 → v0.54.0
golang.org/x/mod v0.37.0 → v0.38.0
golang.org/x/net v0.56.0 → v0.57.0
golang.org/x/sync v0.21.0 → v0.22.0
golang.org/x/sys v0.46.0 → v0.47.0
golang.org/x/term v0.44.0 → v0.45.0
golang.org/x/text v0.39.0 → v0.40.0
golang.org/x/tools v0.47.0 → v0.48.0
google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
modernc.org/cc/v4 v4.28.4 → v4.29.0
modernc.org/ccgo/v4 v4.34.4 → v4.34.6
modernc.org/gc/v3 v3.1.3 → v3.1.4
modernc.org/libc v1.73.4 → v1.74.1
modernc.org/sqlite v1.53.0 → v1.54.0

</details>

(Full Changelog)

README

Grype

A vulnerability scanner for container images and filesystems.

grype-demo

Features

Scan container images, filesystems, and SBOMs for known vulnerabilities (see the docs for a full list of supported scan targets)
Supports major OS package ecosystems (Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon Linux, and more)
Supports language-specific packages (Ruby, Java, JavaScript, Python, .NET, Go, PHP, Rust, and more)
Supports Docker, OCI, and Singularity image formats
Threat & risk prioritization with EPSS, KEV, and risk scoring (see interpreting the results docs)
OpenVEX support for filtering and augmenting scan results

[!TIP]

New to Grype? Check out the Getting Started guide for a walkthrough!

Installation

The quickest way to get up and going:


curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin

[!TIP]

See Installation docs for more ways to get Grype, including Homebrew, Docker, Chocolatey, MacPorts, and more!

The basics

Scan a container image or directory for vulnerabilities:


# container image
grype alpine:latest

# directory
grype ./my-project

Scan an SBOM for even faster vulnerability detection:


# scan a Syft SBOM
grype sbom:./sbom.json

# pipe an SBOM into Grype
cat ./sbom.json | grype

[!TIP]

Check out the Getting Started guide to explore all of the capabilities and features.

Want to know all of the ins-and-outs of Grype? Check out the CLI docs and configuration docs.

Contributing

We encourage users to help make these tools better by submitting issues when you find a bug or want a new feature.

Check out our contributing overview and developer-specific documentation if you are interested in providing code contributions.

Grype development is sponsored by <a href="https://anchore.com/">Anchore</a>, and is released under the <a href="https://github.com/anchore/grype?tab=Apache-2.0-1-ov-file">Apache-2.0 License</a>.

The <a property="dct:title" rel="cc:attributionURL" href="https://anchore.com/wp-content/uploads/2024/11/grype-logo.svg">Grype logo</a> by <a rel="cc:attributionURL dct:creator" property="cc:attributionName" href="https://anchore.com/">Anchore</a> is licensed under <a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license noopener noreferrer" style="display:inline-block;">CC BY 4.0<img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/cc.svg" alt=""><img style="height:22px!important;margin-left:3px;vertical-align:text-bottom;" src="https://mirrors.creativecommons.org/presskit/icons/by.svg" alt=""></a>

For commercial support options with Syft or Grype, please contact Anchore.

Come talk to us!

The Grype Team holds regular community meetings online. All are welcome to join to bring topics for discussion.

Check the calendar for the next meeting date.
Add items to the agenda (join this group for write access to the agenda)
See you there!

Grype

Market and trust evidence

In practice

Use it when

Not the right pick when

Capabilities

Video walkthroughs

Grype open source vulnerability scanner demo

Trivy EP08 |Trivy Alternatives Explained 🔍 | Trivy vs Grype vs Docker Scout

Tool Review - Anchore Tools [ Part 3 ] | GitHub Actions for Syft and Grype

What the repository ships

Latest release v0.116.1

Bug Fixes

Dependencies

Tags

README

Grype

Features

Installation

The basics

Contributing

Come talk to us!

Related tools