Free tool for generating SBOM and CVEs against source or binaries

• trivy

  83 21,443 9.8 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

I've done some work in this space but not specifically on source code. A tool you could try out is Trivy from AquaSecurity. The filesystem scan option might work and can output SBOMs (here's the doc page). Using Trivy for docker images has worked quite well for me thus far so hopefully you have some luck using their filesystem or git repository options!

• osv.dev

  19 1,407 9.7 Python

  Open source vulnerability DB and triage service.

  

Have a look at https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html they have plans for c++ https://github.com/google/osv.dev/issues/783

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• syft

  32 5,495 9.8 Go

  CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  

Suggest a related project