Tuesday, 14 July 2026 @ 14:01 UTC~3313,430150,790

Grype

Anchore Inc·Anchore.Grype

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems.

winget install --id Anchore.Grype --exact --source winget

Latest 0.115.0·June 26, 2026

Release Notes

Added Features

  • emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
  • Merge Go vuln matches with GHSA matches [Issue #3515]

Bug Fixes

  • only emit records for stdlib [PR #3527 @willmurphyscode]
  • mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
  • disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
  • merge in custom ranges when applicable [PR #3514 @willmurphyscode]
  • exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
  • avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
  • Support reading CycloneDX 1.7 SBOMs [Issue #3373]
  • Grype cannot read mariadb version correctly [Issue #3452]
  • grype hangs when downloading certain images using registry client [Issue #3492]
  • Can we get a fix for these Critical findings reported for grype [Issue #3484]

Additional Changes

  • Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
  • Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]

Dependencies 35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated. 🟢 Remediated (5)

  • GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
  • GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
  • GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
  • GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
  • GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2 Updated (31 packages)
  • github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
  • github.com/anchore/bubbly v0.2.0 → v0.2.1
  • github.com/anchore/clio v0.1.0 → v0.1.1
  • github.com/anchore/fangs v0.1.0 → v0.1.1
  • github.com/anchore/go-collections v0.1.0 → v0.1.1
  • github.com/anchore/go-homedir v0.1.0 → v0.1.1
  • github.com/anchore/go-logger v0.1.0 → v0.1.1
  • github.com/anchore/go-lzo v0.1.0 → v0.1.1
  • github.com/anchore/go-macholibre v0.1.0 → v0.1.1
  • github.com/anchore/go-make v0.5.0 → v0.8.0
  • github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
  • github.com/anchore/go-sync v0.1.0 → v0.1.1
  • github.com/anchore/stereoscope v0.2.1 → v0.2.2
  • github.com/anchore/syft v1.45.1 → v1.46.0
  • github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
  • github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
  • github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
  • github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
  • github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
  • github.com/google/go-containerregistry v0.21.6 → v0.21.7
  • github.com/mattn/go-runewidth v0.0.19 → v0.0.21
  • github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
  • github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
  • golang.org/x/crypto v0.52.0 → v0.53.0
  • golang.org/x/mod v0.36.0 → v0.37.0
  • golang.org/x/net v0.55.0 → v0.56.0
  • golang.org/x/sync v0.20.0 → v0.21.0
  • golang.org/x/sys v0.45.0 → v0.46.0
  • golang.org/x/term v0.43.0 → v0.44.0
  • golang.org/x/text v0.37.0 → v0.38.0
  • golang.org/x/tools v0.45.0 → v0.46.0 Added (3 packages)
  • github.com/piprate/json-gold v0.7.0
  • github.com/pquerna/cachecontrol v0.0.0-1555304
  • github.com/tailscale/hujson v0.0.0-ecc657c Removed (1 package)
  • github.com/google/osv-scanner v1.9.2 (Full Changelog)

Installer type: zip

ArchitectureScopeDownloadSHA256
x64—Download1A29532505BF582B8DA80528ED997C786DFAFD9EF5BFEAD3935665A70900BA71

Details

Homepage
https://github.com/anchore/grype
License
Apache-2.0
Publisher
Anchore Inc
Support
https://github.com/anchore/grype/issues
Moniker
grype

Tags

container-imagecontainerscyclonedxdockergogolanghacktoberfestociopenvexsecuritystatic-analysistoolvexvulnerabilitiesvulnerability

Older versions (50)

0.114.0
ArchitectureScopeDownloadSHA256
x64—Download64EB27212B01DEADFAA29259E463F4677B28F5CC3E6A9947E2863CE6DD181F97
0.113.0
ArchitectureScopeDownloadSHA256
x64—Download6841E5990698AFB714E0EAC34E2295207C64636637823B2A861DFEC61CDD98FA
0.112.0
ArchitectureScopeDownloadSHA256
x64—Download94AE49CED125FCA7590FD35DFA96E36F68760CEFFF9A653C92FA8F6842777879
0.111.1
ArchitectureScopeDownloadSHA256
x64—DownloadC871B1F0DCF13E6FAD3716AB67971F8343F03E176E96A0D0D4096B1A7F75CEE8
0.111.0
ArchitectureScopeDownloadSHA256
x64—Download17F3BFB758B3C18426A89060344D9569F4344B0A606D42B60BD89792F996E3BD
0.110.0
ArchitectureScopeDownloadSHA256
x64—Download894154FF277C02ED39C58BD0F6A5F1E3013222E35293698EE9B8B7B60FCA32E1
0.109.1
ArchitectureScopeDownloadSHA256
x64—Download5671D0210E5CE319DD87DF7E641AC3CB793D79C2C29EF07411FD7F5E486B9D63
0.109.0
ArchitectureScopeDownloadSHA256
x64—DownloadF0FD70CFBD473845AA046F11B300BE46503E765DAD5600447C1609BBA6E3158B
0.108.0
ArchitectureScopeDownloadSHA256
x64—DownloadD801059EAF5EC7F3EE8F3C3FA1799BCE559E35590007795292A3BA28DC49C712
0.107.1
ArchitectureScopeDownloadSHA256
x64—DownloadBAABF3B115094A9D8348BB820D97AAE8D6A2A8EF956673211AB366825053A4D1
0.107.0
ArchitectureScopeDownloadSHA256
x64—DownloadAA35F4DB5A5B54E484550DF8B858AED8529BB9E01CEC863524C00237E77649CE
0.106.0
ArchitectureScopeDownloadSHA256
x64—Download6C5986083F181D6532B43600A574F539253A8A392128333573E0689F47B12949
0.105.0
ArchitectureScopeDownloadSHA256
x64—DownloadEBF1B3B359D49BE320494D7D6A4E7DB19DDECA25D4E43C2994B74ED259DB2BAE
0.104.4
ArchitectureScopeDownloadSHA256
x64—Download83CB87080BB594EF367603C27E7D236D9AEEE18B8F7E01171E179C938A5B711D
0.104.3
ArchitectureScopeDownloadSHA256
x64—Download8DAD9D3AD2D623A793728C8C18352282AD2B1ECE506A5BCC4A086BF6AF425DC8
0.104.2
ArchitectureScopeDownloadSHA256
x64—Download4C400C8459773BC68AD8510BAE7F7E896FFF7B5CFF9FD4F4AD47286500C0C0A5
0.104.1
ArchitectureScopeDownloadSHA256
x64—DownloadE3086B6131A5313D357DD68D69B740B5A4A39E75E561EDE53CCBDA93073D2F97
0.104.0
ArchitectureScopeDownloadSHA256
x64—Download328200F75CAD5E9D9495CDE3B28A58245780DC32E181663F9EE5525DDF4AB03C
0.103.0
ArchitectureScopeDownloadSHA256
x64—DownloadC8AE582EA393D948CC6AFA1B772139DA8AAA3D4D97C8BCAE4112F7F058183EC2
0.102.0
ArchitectureScopeDownloadSHA256
x64—Download33BD750A4E2265F610B74593BB4D560095FE1822E875C1CB82149E451B05F12C
0.101.1
ArchitectureScopeDownloadSHA256
x64—DownloadC73FF538526797334EC6205248538B0A27057A82C4E2549DCEFAA10F35BF35F4
0.101.0
ArchitectureScopeDownloadSHA256
x64—Download61665A0F5D866BD93136340FED37FA64D979A85552047BF33C3597E9A77703AA
0.100.0
ArchitectureScopeDownloadSHA256
x64—Download824446266F0E8F50208E247360B71D3B82B71DB7A63752C23C1182B91FA453DD
0.99.1
ArchitectureScopeDownloadSHA256
x64—Download980B3907DB6CFD7870C5769050A2892372AA718EC95997CC152584F13D26FFF2
0.99.0
ArchitectureScopeDownloadSHA256
x64—Download2F012D11B3BFE69E1BB3177624DBCE84FB917BC1530AF2D07CCFD19D8A110540
0.98.0
ArchitectureScopeDownloadSHA256
x64—Download3BC6DEC6A736A38AB6454943A468DEC3B8D01C22F06C2CF8F43210DFF161F28A
0.97.2
ArchitectureScopeDownloadSHA256
x64—Download86E45C3D225BC8B8400475F9542B708D52993134252305FD264252E9886D029D
0.97.1
ArchitectureScopeDownloadSHA256
x64—Download1D216CD2C22E3D1611DB55B16BDADDB8024B20978F31EA019E31A4EF26E0322A
0.97.0
ArchitectureScopeDownloadSHA256
x64—Download9C84BCC43922ECDB10F0499FFB53D55692544865CA26BCB1288256650D3B256D
0.96.0
ArchitectureScopeDownloadSHA256
x64—DownloadDEF6D52396A6947685B07CD86061C2DD27535BACFD6AF436C06A57A56236710E
0.95.0
ArchitectureScopeDownloadSHA256
x64—Download0356AC41A134BFDEF9A7332C344705F924D7418A238562E91D5AF825F1F0E15E
0.94.0
ArchitectureScopeDownloadSHA256
x64—Download7A2C25F863551BAF094A81C3E55A0EE80AE5DF1D55C15622EBA6BAB15A598B85
0.93.0
ArchitectureScopeDownloadSHA256
x64—Download2F34EA1A974071566FE4371B51DDEA60D42BE511B530517DF37A807D0AF166B4
0.92.2
ArchitectureScopeDownloadSHA256
x64—DownloadF93F7B40C98EC8D5918EE0CF81A58FB7770B0BE1C2E7E35D4F834E9EB53A697C
0.92.1
ArchitectureScopeDownloadSHA256
x64—Download8E874C8530B073F4FF003E69F39AAB94B44C26EF0C7F89D9A0A7AE88D174CC72
0.91.2
ArchitectureScopeDownloadSHA256
x64—Download8335D011CC7A6DCA2900C5D12D1BC70A2E810EDD0BB6A905DFA6EFA1CE5E7074
0.91.1
ArchitectureScopeDownloadSHA256
x64—DownloadC5EB57845B97BFF96844C75D54DD9A4D4FAC348E0750E2CD94697A5BE2509DB3
0.91.0
ArchitectureScopeDownloadSHA256
x64—Download18658F8CE5A387F8AA932BDA0732661949450F3521FADDEE8C86C0C4262C2486
0.90.0
ArchitectureScopeDownloadSHA256
x64—DownloadD295F6933DADE7758BBFEA1EBC29E34CE2E90DF30988A2FD4F3416BC7AC59C8C
0.89.1
ArchitectureScopeDownloadSHA256
x64—Download3E6BA8711A9EBD8A0EB3FC386D99F66C512E1F429A5BE71FE321627A680F42EB
0.89.0
ArchitectureScopeDownloadSHA256
x64—DownloadAADAD309FDAFC166643398EBE7FCE5BFB1BCEA7A18EAABFCE683591563706132
0.88.0
ArchitectureScopeDownloadSHA256
x64—Download6349A5BC33FFC58A0B2E4E600F55BEB093E07324630B85FD4743EA7CEBC9B7A4
0.87.0
ArchitectureScopeDownloadSHA256
x64—Download9520DF07EB82227E4F73173E4784402B460DAA95930159A005A5B9BA3F6D7FAE
0.86.1
ArchitectureScopeDownloadSHA256
x64—Download1A903D4420765B09F7CD400EE89F34ACC6824240DBD9A52BEF1C29BFEDA851BE
0.86.0
ArchitectureScopeDownloadSHA256
x64—DownloadEED2CE945C3F08E97878746CC2474809332844AF32E306DB3C4DB669AF28AE70
0.85.0
ArchitectureScopeDownloadSHA256
x64—Download0EC5E3698FED948CBB849C7E78D76BFAD355BBEF3324A801920999E7130F64AB
0.84.0
ArchitectureScopeDownloadSHA256
x64—DownloadB8670FAEDCB3C993F09C31DB184EBDA5EADD4120891419C420DBE7527507307C
0.79.1
ArchitectureScopeDownloadSHA256
x64—Download4ACE248B572496C7B23691674A1B8854D68E12519F9F56998955D953FE86FB7B
0.74.2
ArchitectureScopeDownloadSHA256
x64—Download00941EFAD5BB3C924EE4C9CEC10A868D80A1AD35EDF7756FBDC51B994B45F2DB
0.69.0
ArchitectureScopeDownloadSHA256
x64—DownloadC315F904690A08D28DBA65D5107F4DA44605B1198B6C6667AD13CB87FC7F14CC