Tool

CLI

Vulnerability Management

osv-scanner

by google

8.4Kstars

515forks

63watchers

Updated 2 months ago

About

OSV-Scanner is a Go-based vulnerability scanner that identifies security issues in project dependencies using the comprehensive OSV.dev database.

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

Primary Use Case

Developers and security teams use OSV-Scanner to automatically detect known vulnerabilities in their project's dependencies across multiple languages and package managers, enabling proactive vulnerability management. It is especially useful in DevSecOps pipelines to ensure continuous security monitoring and guided remediation of vulnerable packages.

Key Features

Supports multiple programming languages including C/C++, Dart, Elixir, Go, Java, JavaScript, PHP, Python, R, Ruby, and Rust
Compatible with various package managers such as npm, pip, yarn, maven, go modules, cargo, gem, composer, and nuget
Detects vulnerabilities in Linux OS packages and container images
Provides guided remediation recommendations for package upgrades based on severity and fix strategy
Uses the open and authoritative OSV.dev vulnerability database
Integrates with OSV-Scalibr library for extensible scanning capabilities
Offers CLI interface and official frontend to OSV.dev
Open source with community-driven advisory improvements

Installation

Download a prebuilt binary for your platform from the GitHub releases page: https://github.com/google/osv-scanner/releases
Alternatively, build from source using Go: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest

Usage

>_ osv-scanner

Runs the OSV-Scanner CLI to scan a project’s dependencies for known vulnerabilities

>_ go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest

Installs the latest version of OSV-Scanner from source using Go

Security Frameworks

Reconnaissance

Discovery

Defense Evasion

Collection

Impact

Usage Insights

Integrate OSV-Scanner into CI/CD pipelines for continuous vulnerability detection and early remediation.
Use OSV-Scanner's guided remediation to prioritize patching based on severity and dependency impact.
Combine OSV-Scanner results with threat intelligence feeds to enhance vulnerability context during purple team exercises.
Leverage OSV-Scanner's multi-language support to secure polyglot applications and container images comprehensively.
Automate vulnerability reporting workflows by integrating OSV-Scanner outputs with ticketing and incident response platforms.

Docs Take 2 Hours. AI Takes 10 Seconds.

Ask anything about osv-scanner. Installation? Config? Troubleshooting? Get answers trained on real docs and GitHub issues—not generic ChatGPT fluff.

3 free chats per tool • Instant responses • No credit card

Security Profile

Red Team80%

Blue Team60%

Purple Team70%

Details

LicenseApache License 2.0

LanguageGo

Open Issues472

Topics

scanner

security-audit

security-tools

vulnerability-scanner

Related Tools

trivy

aquasecurity/trivy

Tool

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

32.3K

about 1 month ago

nuclei

projectdiscovery/nuclei

Tool

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

26.6K

3 months ago

lynis

CISOfy/lynis

Tool

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

15.1K

2 months ago