# vulnerability scanner Published articles for vulnerability scanner. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## There's a libcurl.dll in my system32 DevFeed: [There's a libcurl.dll in my system32]() Original publisher: [Read original article]() Author: Daniel Stenberg Published: 2026-08-17T21:27:36Z Content type: opinion Language: en Sources: [Daniel Stenberg]() Topics: [cURL](), [Windows](), [Vulnerabilities](), [Library]() Tags: [curl](), [curl-and-libcurl](), [vulnerabilities](), [vulnerability-scanner](), [windows]() ### AI overview The article explains why a vulnerable libcurl.dll found in Windows System32 cannot safely be upgraded generically. Different Windows applications may install or build libcurl separately, so the application owner must identify and update the specific DLL. ### Source excerpt This afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it. Their vulnerability scanner identified it as vulnerable to several publicly known vulnerabilities. Can we bump it to the latest version please? ... Continue reading There's a libcurl.dll in my system32 -> ## Docker Hodgepodge Images DevFeed: [Docker Hodgepodge Images]() Original publisher: [Read original article]() Published: 2026-04-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Docker Hardened Images](), [supply-chain-security](), [vulnerability](), [Docker]() Tags: [chainguard-vs-docker](), [dhi](), [docker](), [docker-containers](), [docker-hardened-images](), [docker-images](), [free-container-images](), [security](), [supply-chain-security](), [vulnerability](), [vulnerability-scanner]() ### AI overview The article argues that Docker Hardened Images are Debian Trixie derivatives rather than ordinary Debian images. It contends that Docker's custom repository, rebuilt packages, and operating-system identification can cause vulnerability scanners and related tools to produce inaccurate results, creating supply chain security concerns. ### Source excerpt Docker ships their own Linux distro, they just pretend not to. Learn how misidentification and VEX usage can mislead scanners and impact supply chain security. ## Supply chain attacks expose weaknesses in open-source software trust DevFeed: [Supply chain attacks expose weaknesses in open-source software trust]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [vulnerability](), [Exploit](), [npm]() Tags: [ai-coding](), [attacks](), [chainguard](), [code](), [dependency](), [hardening](), [npm](), [open-source](), [open-source-security](), [oss](), [pypi](), [scanner](), [secrets](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [trust](), [vibe-coding](), [vulnerability](), [vulnerability-scanner]() ### AI overview This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening. ### Source excerpt Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix. ## Turn Dependabot Off DevFeed: [Turn Dependabot Off]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-02-20T19:48:08Z Content type: opinion Language: en Sources: [Filippo Valsorda]() Topics: [GitHub Actions](), [Go Language](), [Vulnerabilities](), [ci]() Tags: [ci](), [dependabot](), [github-actions](), [go](), [security](), [vulnerabilities](), [vulnerability-scanner]() ### AI overview The article argues that Dependabot creates excessive and often irrelevant security-alert noise in the Go ecosystem. It recommends replacing Dependabot with scheduled GitHub Actions that run govulncheck and tests against the latest dependency versions, and using vulnerability scanners that filter by package and vulnerable-symbol reachability. ### Source excerpt I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies. ## Introducing Scanfrog: Dodge Container Vulnerabilities DevFeed: [Introducing Scanfrog: Dodge Container Vulnerabilities]() Original publisher: [Read original article]() Published: 2025-07-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [vulnerability scanning](), [vulnerability management](), [grype](), [chainguard](), [chainguard containers](), [Security](), [Terminal](), [arcade](), [Open Source]() Tags: [anchore](), [chainguard](), [chainguard-containers](), [container](), [container-image](), [container-image-vulnerabilities](), [container-images](), [containers](), [free](), [games](), [grype](), [management](), [open-source](), [scanfrog](), [security](), [terminal](), [vulnerabilities](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview Scanfrog is a Frogger-style terminal game that turns vulnerabilities found in a container image into game obstacles. It uses Grype, a free and open-source vulnerability scanner, to create levels based on vulnerability-scanning results and illustrates why reducing vulnerabilities improves software security. ### Source excerpt Scanfrog is a Frogger-style game created by one of Chainguard's engineers to showcase how difficult it can be to dodge vulnerabilities in containers. ## How Chainguard Integrates with Vulnerability Scanners DevFeed: [How Chainguard Integrates with Vulnerability Scanners]() Original publisher: [Read original article]() Published: 2025-06-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability](), [Containers](), [chainguard containers](), [Open Source]() Tags: [chainguard](), [chainguard-containers](), [container](), [container-image](), [go](), [grype](), [oci](), [open-source](), [open-source-scanners](), [orca-security](), [popular-container-image-scanners](), [scanner-integration](), [trivy](), [vulnerability](), [vulnerability-scanner]() ### AI overview The article explains how vulnerability scanners inspect software artifacts, identify included packages and versions, and compare them with databases of known vulnerabilities. It focuses on the challenges of integrating Chainguard software and container images with supported scanners so they can accurately report vulnerability status. ### Source excerpt Chainguard Containers have extensive scanner integrations with many of the most popular container image scanners. Discover more about our integrations. ## CVE-2019-3826 as a false positive in OPA Gatekeeper Images DevFeed: [CVE-2019-3826 as a false positive in OPA Gatekeeper Images]() Original publisher: [Read original article]() Published: 2023-10-31T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Vulnerabilities](), [Prometheus](), [opa](), [GitHub]() Tags: [analysis](), [chainguard](), [chainguard-images](), [cve](), [cve-2019-3826](), [cves](), [deployment](), [false-positive](), [opa](), [prometheus](), [security](), [vulnerabilities](), [vulnerability](), [vulnerability-scanner]() ### AI overview This article explains that CVE-2019-3826 affects applications using Prometheus for metrics when they expose the web UI. It presents the Chainguard OPA Gatekeeper Image as unaffected because it does not expose that UI, making the scanner result a false positive. ### Source excerpt Unveil the false positive of CVE-2019-3826 and combat phantom menaces with Chainguard's vigilant security. ## Grype Adds OpenVEX Support for Vulnerability Analysis DevFeed: [Grype Adds OpenVEX Support for Vulnerability Analysis]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [openvex](), [supply-chain-security](), [vulnerability management](), [anchore](), [chainguard](), [Security]() Tags: [anchore](), [chainguard](), [cve](), [cybersecurity-and-infrastructure-security-agency](), [grype](), [openssf](), [openvex](), [scanner](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [vex](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview Grype, Anchore's open-source vulnerability scanner, now supports OpenVEX, a machine-readable standard for vulnerability analysis. The article explains how this can provide context for vulnerabilities and help reduce false positives and vulnerability-management effort. ### Source excerpt Open source vulnerability scanner Grype has added support for OpenVEX, making software supply chain security easier. Learn how to implement it today. ## How a false negative obscured CVE-2023-2454 in a PostgreSQL image DevFeed: [How a false negative obscured CVE-2023-2454 in a PostgreSQL image]() Original publisher: [Read original article]() Published: 2023-10-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [Vulnerabilities](), [chainguard images](), [trivy](), [PostgreSQL]() Tags: [chainguard-images](), [container-security](), [cve-2023-2454](), [false-negative](), [postgresql](), [trivy](), [vulnerability](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article explains how insufficient vulnerability database metadata can cause a scanner to miss CVE-2023-2454 in a PostgreSQL image. It presents Chainguard Images as often containing fixes for vulnerabilities that scanners miss. ### Source excerpt Unearth a haunting tale of overlooked threats in scanning. Discover how Chainguard Images counteract gaps, ensuring robust defense against CVEs. ## Stemming the tide of false positive vulnerabilities DevFeed: [Stemming the tide of false positive vulnerabilities]() Original publisher: [Read original article]() Published: 2023-09-11T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [chainguard](), [chainguard images](), [open-source-security](), [Tooling]() Tags: [chainguard](), [chainguard-images](), [cve](), [false-positives](), [false-postive](), [open-source](), [scanner](), [security](), [vulnerabilities](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview Chainguard Labs presents tooling intended to identify false-positive vulnerability reports, including cases where a vulnerable library is not exploitable. The article describes research using vulnerable symbols to help prioritize vulnerabilities that require attention. ### Source excerpt Tackle false positive vulnerabilities with Chainguard's innovative tooling to prioritize genuine threats and secure your software. ## Fuzzy CVEs, tarfiles, and untrusted input DevFeed: [Fuzzy CVEs, tarfiles, and untrusted input]() Original publisher: [Read original article]() Published: 2023-07-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Vulnerabilities](), [common vulnerabilities and exposures](), [Python](), [Open Source](), [Maintainers](), [NVD]() Tags: [common-vulnerabilities-and-exposures](), [cve](), [cves](), [cybersecurity](), [go](), [maintainers](), [nvd](), [open-source](), [python](), [scanner](), [scanners](), [software-supply-chain](), [vulnerability-scanner](), [vulnerability-scanning](), [wolfi]() ### AI overview This article examines CVE-2007-4559 in Python's tarfile module, why the 15-year-old issue may still appear in security scanners, and why its classification as a vulnerability is disputed. It discusses CVE processes, NVD entries, open-source maintainer constraints, and the risks of extracting untrusted tarfile inputs. ### Source excerpt Navigate fuzzy CVEs, tarfiles, and untrusted input with Chainguard, paving the way to secure coding practices. ## A thought experiment on using low-vulnerability Chainguard Images to speed government software delivery DevFeed: [A thought experiment on using low-vulnerability Chainguard Images to speed government software delivery]() Original publisher: [Read original article]() Published: 2023-06-20T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [chainguard images](), [authority to operate](), [vulnerability management](), [chainguard](), [chainguard labs](), [Security]() Tags: [ato](), [authority-to-operate](), [chainguard](), [chainguard-images](), [chainguard-labs](), [container-security](), [containers](), [fedramp](), [government](), [image-cves](), [secure-container-image](), [secure-minimal-image](), [security](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview This opinion article proposes studying whether Chainguard Images with zero-known or low vulnerability counts could reduce timelines and staff costs in government Authority to Operate processes. It presents this as a hypothesis requiring comparison with other ATO processes, not as a demonstrated result. ### Source excerpt Discover how 0-known vulnerability containers from Chainguard Labs could accelerate software delivery to the government. ## A purl of wisdom on SBOMs and vulnerabilities DevFeed: [A purl of wisdom on SBOMs and vulnerabilities]() Original publisher: [Read original article]() Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [Vulnerabilities](), [supply-chain-security]() Tags: [chainguard-images](), [component](), [components](), [container-images](), [false-positive](), [nvd](), [package-url](), [purl](), [sbom](), [sboms](), [scanner](), [software-bill-of-materials](), [software-supply-chain](), [vulnerabilities](), [vulnerability-data](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%. ### Source excerpt SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%.