E-GRY
Grype
Vulnerability scanner for container images, filesystems, and SBOMs.
OVERVIEW
Grype (github.com/anchore/grype), also from Anchore, takes a container image, filesystem path, or a Syft-generated SBOM and matches every package it finds against a continuously updated vulnerability database, reporting known CVEs by package, installed version, and severity.
Because it accepts an SBOM directly, Grype pairs naturally with syft: generate the SBOM once during image analysis, then run Grype against it (or several vulnerability databases over time) without repeating the slower image-unpacking step, which is the standard pattern for scanning the same base images across a large set of services.
USE CASES
Practical use cases
- 01
Scanning a container image directly for known CVEs by package and version.
- 02
Running Grype against a previously generated Syft SBOM to avoid re-analyzing the image.
- 03
Gating a CI/CD pipeline on severity thresholds to catch newly disclosed CVEs in existing images.
- 04
Comparing scan results across image tags to see which base image versions carry fewer known vulnerabilities.
QUICK START
Once container images are identified in scope, to quickly flag known CVEs by package and version before manual triage.
- Confirm which images or SBOMs are in scope for vulnerability scanning.
- Install Grype from a release binary or package manager.
- Run Grype against the target image (or a Syft SBOM) to get a CVE report.
- Triage each finding for actual exploitability and reachability, not just presence in the report.
grype app:latest -o tableBEFORE YOU RUN IT
What to check before running it
A CVE match means the vulnerable package version is present, not that it's reachable or exploitable in this deployment — triage before reporting severity as-is.
The vulnerability database has coverage gaps and version-matching false positives; cross-check high-severity findings against the vendor advisory before including them in a report.
Scanning a client's production images pulled from their registry still counts as touching client infrastructure — confirm pull access is within the agreed scope.