Tag
OSV-Scanner is Google's dependency scanner, announced in 2022, that queries the open OSV.dev database rather than raw CVE advisories. Because OSV pins each vulnerability to precise commit or semantic version ranges, matching against your actual dependencies becomes deterministic and produces far less noise. It reads npm, Python, Go, Ruby, PHP, Rust and Maven manifests.
CVE-based attack surface management has moved from an abstract list to an engineering practice with real prioritization. We look at how it works once EPSS, KEV and exposure context enter the same equation.
VEX, the Vulnerability Exploitability eXchange, is a structured way for a vendor to state whether a CVE listed in an SBOM actually affects a product. Log4Shell in December 2021 showed why it exists: countless Java applications carried that critical CVE while never loading the vulnerable class. VEX marks which vulnerabilities are not exploitable, so scanner noise becomes signal.
Trivy and Grype are the two leading open-source tools for container image scanning in CI/CD pipelines. Both detect CVEs in OS packages and language dependencies with less than 5% coverage difference. Trivy stands out for IaC scanning; Grype natively integrates the SBOM workflow with Syft.
