Tag
OSV-Scanner is Google's dependency scanner, announced in 2022, that queries the open OSV.dev database rather than raw CVE advisories. Because OSV pins each vulnerability to precise commit or semantic version ranges, matching against your actual dependencies becomes deterministic and produces far less noise. It reads npm, Python, Go, Ruby, PHP, Rust and Maven manifests.
CVE-based attack surface management has moved from an abstract list to an engineering practice with real prioritization. We look at how it works once EPSS, KEV and exposure context enter the same equation.
VEX, the Vulnerability Exploitability eXchange, is a structured way for a vendor to state whether a CVE listed in an SBOM actually affects a product. Log4Shell in December 2021 showed why it exists: countless Java applications carried that critical CVE while never loading the vulnerable class. VEX marks which vulnerabilities are not exploitable, so scanner noise becomes signal.
Trivy and Grype have spent years competing to be the default container scanner. Trivy broadened its scope to IaC, Kubernetes, and Git repos in one binary; Grype specialised in SBOM precision and lower false-positive rates. After a year of intensive CI use with real images, here is a side-by-side breakdown of where each one wins.
Docker Scout continuously scans container images against CVE databases including NVD and ecosystem-specific advisories, and recommends base-image changes to remove vulnerabilities. Built into Docker Desktop and Hub, it competes with Trivy, Grype and Snyk. Best fit for teams already running end-to-end on the Docker ecosystem.
