Alternatives to OSV-Scanner
Check project dependencies against the OSV vulnerability database. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
OSV-Scanner
Check project dependencies against the OSV vulnerability database.
Replacements
Listings that take over the same core job as OSV-Scanner.
Grype
Find known vulnerabilities in container images and filesystems.
Grype also scans container images, filesystems and SBOMs for known vulnerabilities, with results tied to its own package identification and database coverage.
Trivy
Scan software and infrastructure for known security issues.
Trivy extends dependency scanning to containers, filesystems and infrastructure configuration checks, all in one Apache-2.0 command-line tool.
Dependency-Check
OWASP scanner that finds known vulnerabilities in a project's dependencies.
Dependency-Check is the OWASP scanner that matches dependencies to CPE identifiers and plugs into Maven, Gradle and Jenkins, but needs an NVD API key and produces false positives.
Dependency-Track
Track component risk using software bills of materials.
Dependency-Track is a self-hosted web platform tracking component risk from SBOMs over time, rather than a one-off command-line check.
Similar software
Related functionality, not a direct replacement.
Syft
Generate software bills of materials from images and files.
Semgrep
Find code patterns and potential problems with static analysis.
Gitleaks
Scans Git repositories, files and pipelines for leaked secrets.
TruffleHog
Find exposed credentials in repositories and other data sources.
DefectDojo
An open source, self-hosted vulnerability management platform that collects and tracks findings from security scanners.
Checkov
Scan infrastructure code for configuration problems.
