OSV-Scanner
by Google
Scan dependencies for known vulnerabilities using the OSV.dev database
Visit google.github.io FreeOpen source
OSV-Scanner is Google's open-source CLI that reads lockfiles, SBOMs, and container images and matches dependencies against the OSV.dev vulnerability database. It covers many ecosystems, supports ignore rules and license checks, and can suggest version upgrades that fix findings.
Key features
- Lockfile and SBOM scanning
- Container image scanning
- Backed by the OSV.dev database
- Guided remediation for upgrades
- GitHub Action
Similar tools
Trivy
Find vulnerabilities, misconfigurations, and secrets in containers and code
TruffleHog
Find and verify leaked credentials in code, history, and cloud storage
CodeQL
GitHub's semantic code analysis engine for finding vulnerabilities
Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
ZAP
Open-source web application security scanner and intercepting proxy
