Trivy

Trivy is a comprehensive security scanner from Aqua Security that checks a wide range of targets - container images, filesystems, remote Git repositories, virtual machine images, and running Kubernetes clusters - for security issues in one tool instead of separate scanners for each concern. Its scanners cover known vulnerabilities (CVEs) in OS packages and application dependencies, infrastructure-as-code misconfigurations, hardcoded secrets, and software license issues, and it can generate a software bill of materials (SBOM) for a scanned target.

It's commonly run as a CLI locally, as a container image, or wired into CI pipelines as a security gate that fails a build when it finds a vulnerability above a chosen severity threshold, and its broad language and platform coverage means most stacks are supported without extra plugins.

Trivy is a fit for teams that want a single, fast scanner covering vulnerabilities, misconfigurations, and secrets across their whole software supply chain - complementing Open Policy Agent (also in this catalog), which enforces policy going forward, while Trivy finds what's already wrong in existing images, code, and infrastructure.