anchore/grype

View on GitHub

A vulnerability scanner for container images and filesystems

Stars: 12.9k
Forks: 880
Open beginner issues: 0
Indexed issues: 329
Avg merge: 2d 13h
Merged PRs (30d): 22

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 11, 2026
Latest indexed: Sep 14, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue help wanted

Open All

326 open issues indexed

Extend vulnerability matchers Open

ecosystem:javascript ecosystem:os ecosystem:python good-first-issue

anchore/grype#29 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Presenter that is pkg centric (not vuln id centric) Open

anchore/grype#42 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Support multiple DB distribution archive types Open

anchore/grype#590 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Add "confidence indication" to vulnerability matches Open

help-wanted

anchore/grype#52 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add integration test for update check Open

anchore/grype#68 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Distro matchers should be guided by package metadata not detected distro Open

anchore/grype#86 · 14 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Write golang matcher against NVD Open

ecosystem:go

anchore/grype#92 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add text presenter Open

anchore/grype#96 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add package URL to the CycloneDX output Open

enhancement I/O

anchore/grype#172 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Java cataloger reports various packages by the wrong name Open

ecosystem:java false-negative spike

anchore/grype#192 · 4 comments · 1 reaction · 1 assignee · Indexed Sep 14, 2026
Return results based on severity Open

documentation enhancement

anchore/grype#197 · 7 comments · 11 reactions · 1 assignee · Indexed Sep 14, 2026
Improve alpine matching for EOL distro versions Open

enhancement

anchore/grype#210 · 5 comments · 7 reactions · 0 assignees · Indexed Sep 14, 2026
Add json schema Open

enhancement I/O

anchore/grype#214 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Map fedora distro namespace to EL version Open

bug

anchore/grype#223 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
No FIXED-IN values for CVE findings Open

bug

anchore/grype#236 · 7 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Checking for DB updates can severely increase execution time Open

bug

anchore/grype#239 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
better errors needed when database can't get updated Open

enhancement good-first-issue

anchore/grype#265 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Showing misleading vulnerability and "fixed in version" information due to source RPM package matching Open

bug

anchore/grype#266 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
CVEs fixed in Alpine and Busybox minor or patch versions should be reported by grype Open

enhancement

anchore/grype#278 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Allow for Matcher configurations Open

enhancement

anchore/grype#282 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Update "artifact" to "package" in output Open

I/O

anchore/grype#318 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Docs for using templates should point to view models, not JSON output Open

bug documentation good-first-issue

anchore/grype#333 · 6 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Add datetime to json descriptor output Open

enhancement question

anchore/grype#355 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Running grype from docker may result in no output Open

bug I/O

anchore/grype#372 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Reporting "won't fix" erroneously for certain Debian vulnerabilities Open

bug

anchore/grype#386 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Provide overview documentation on Docker Hub page Open

documentation enhancement

anchore/grype#388 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Unexpected carriage returns in JSON output Open

bug I/O

anchore/grype#394 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Metadata sub-fields do not start with a lowercase letter Open

bug I/O

anchore/grype#399 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Wrong image digest set as version in cyclonedx output Open

bug

anchore/grype#435 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Expiry date for ignore rules Open

enhancement

anchore/grype#452 · 10 comments · 14 reactions · 0 assignees · Indexed Sep 14, 2026
sign Grype container image via cosign Open

enhancement

anchore/grype#474 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Provide feedback to user when an exact manifest digest was not provided Open

enhancement I/O

anchore/grype#485 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add support for scanning Kali linux Open

enhancement

anchore/grype#515 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add support for reading attached SBOMs to an image in cosign format Open

enhancement

anchore/grype#519 · 6 comments · 2 reactions · 1 assignee · Indexed Sep 14, 2026
Add support for reading SBOMs on the image attached by buildpacks Open

enhancement

anchore/grype#520 · 6 comments · 7 reactions · 0 assignees · Indexed Sep 14, 2026
Create project website Open

documentation

anchore/grype#527 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add RustSec DB source Open

enhancement new-data-source

anchore/grype#529 · 9 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Add Golang DB source Open

ecosystem:go enhancement new-data-source

anchore/grype#530 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 14, 2026
Add PyPA DB source Open

ecosystem:python enhancement new-data-source

anchore/grype#531 · 8 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Grype doesn't detect CVE-2021-43798 Open

bug false-negative

anchore/grype#534 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Enhancement request to support the Common Security Advisory Framework (CSAF) format Open

enhancement good-first-issue

anchore/grype#536 · 1 comment · 2 reactions · 0 assignees · Indexed Sep 14, 2026
specify key/values that are added to the report Open

enhancement

anchore/grype#537 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Run Grype scan of files given from text file containing filelist Open

enhancement multiple-sources

anchore/grype#562 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Allow false positive data to be dynamically updated Open

enhancement

anchore/grype#569 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Ability to scan OVA format images Open

enhancement

anchore/grype#573 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Vulnerabilities not found, probably due to some file errors Open

bug needs-investigation windows

anchore/grype#588 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
generate fig autocompletion Open

enhancement good-first-issue

anchore/grype#604 · 3 comments · 6 reactions · 1 assignee · Indexed Sep 14, 2026
Provide vulnerability attestation based on cosign vuln spec Open

enhancement good-first-issue

anchore/grype#614 · 7 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Curate a known FP list and filter all results Open

enhancement

anchore/grype#616 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Grype filtering through CVSS vector Open

enhancement

anchore/grype#620 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026

anchore/grype

Get new issues in your inbox