osv-scanner

Vulnerability scanner for open source dependencies and SBOMs

OSV-Scanner is Google's official frontend to the OSV.dev vulnerability database. It scans a project's dependencies (lockfiles, SBOMs, container images, Git submodules and installed artifacts), matches them against known vulnerabilities in the OSV database, and reports actionable results. It also supports guided remediation to help upgrade affected packages.

homepage ↗homepage ↗ github: google/osv-scanner