# vulnerability scanning Published articles for vulnerability scanning. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## We invited a direct competitor into Security Hub Extended. Here's why. DevFeed: [We invited a direct competitor into Security Hub Extended. Here's why.]() Original publisher: [Read original article]() Author: Michael Fuller Published: 2026-08-31T19:00:07Z Content type: opinion Language: en Sources: [AWS Security Blog]() Topics: [AWS Security Hub](), [Security & compliance, Cloud security](), [workload protection](), [vulnerability scanning](), [eBPF](), [Linux Kernel]() Tags: [announcements](), [aws-security-hub](), [cloud-security](), [container](), [ebpf](), [foundational-100](), [linux-kernel](), [security](), [security-blog](), [security-identity-compliance](), [vulnerability-scanning](), [workload-protection]() ### AI overview AWS explains why it invited Upwind, a cloud security competitor, into Security Hub Extended. The post says the partnership responds to customer demand, expands choice between posture management and runtime-first protection, and simplifies integration through AWS billing, support, and operations. ### Source excerpt When customers keep pointing you to a solution that overlaps with parts of your own offering, you have a choice to make. This post is about the choice we made with Upwind, and why we'd make it again. AWS Security Hub Extended exists because customers told us what was working for them in enterprise security [...] ## Why repository-centric security still needs an artifact access control plane DevFeed: [Why repository-centric security still needs an artifact access control plane]() Original publisher: [Read original article]() Author: Adrian Herrera Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [supply-chain-security](), [CI/CD](), [Security](), [Authorization](), [iac-security]() Tags: [access-control](), [ci-cd](), [infrastructure-as-code](), [security](), [security-policies](), [software-supply-chain](), [vulnerability](), [vulnerability-scanning]() ### AI overview The article explains that repository-centric security controls can leave gaps because dependency access is distributed across CI runners, ephemeral build agents, public registries, developer tooling, and automation. It argues for an artifact access control plane, including Virtual Registries, to enforce security policies inline across CI/CD execution paths, complementing repository-based vulnerability scanning, license analysis, dependency governance, and remediation. ### Source excerpt Repository security gaps: Distributed dependency access bypasses centralized analysis. Virtual Registries offer the critical inline control plane to enforce artifact security policies across your CI/CD pipeline. ## CMMC Phase 2, explained: Requirements, deadlines, and who's affected DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Security & Privacy](), [Cryptography](), [vulnerability management](), [vulnerability scanning](), [Encryption](), [MFA]() Tags: [certificates](), [cmmc](), [cmmc-container-images](), [cmmc-phase-2](), [cmvp](), [compliance](), [cve](), [cybersecurity-maturity-model-certification](), [fips](), [nist](), [sboms](), [stig](), [stigs](), [supply-chain](), [u-s-dod](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation. ### Source excerpt CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers. ## SecDB is the past, OSV is the future DevFeed: [SecDB is the past, OSV is the future]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [vulnerability](), [Vulnerabilities](), [chainguard packages](), [Security]() Tags: [chainguard](), [chainguard-containers](), [chainguard-scanners](), [cves](), [deprecated](), [open-source-vulnerabilities](), [osv](), [secdb](), [security](), [vulnerability](), [vulnerability-data](), [vulnerability-scanning]() ### AI overview Chainguard is deprecating its SecDB vulnerability feed and plans to sunset it at the end of 2026. The company is moving toward the OSV schema because it supports more precise vulnerability data, including unfixed vulnerabilities and component-level advisory details. ### Source excerpt Chainguard is deprecating SecDB in favor of OSV, delivering more accurate, granular vulnerability data and better visibility for modern software supply chains. ## It's time to rethink golden images. Chainguard can help. DevFeed: [It's time to rethink golden images. Chainguard can help.]() Original publisher: [Read original article]() Published: 2025-11-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [Containers](), [DevOps](), [Tech Debt]() Tags: [base-images](), [chainguard](), [chainguard-containers](), [chainguard-golden-images](), [chainguard-images](), [containers](), [development](), [devops](), [golden-container-images](), [golden-images](), [security](), [vulnerabilities](), [vulnerability-scanning]() ### AI overview Chainguard advocates developer-centric golden image programs built on secure, trusted, purpose-built container base images. The approach aims to balance governance and standardization with developer flexibility, improving delivery speed while reducing maintenance costs, vulnerabilities, and compliance concerns. ### Source excerpt Chainguard helps teams build developer-centric golden image programs with zero-CVE, purpose-built containers--balancing speed, security, and standardization. ## Introducing Our Newest Ecosystem Integration: Anchore Enterprise DevFeed: [Introducing Our Newest Ecosystem Integration: Anchore Enterprise]() Original publisher: [Read original article]() Published: 2025-09-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [anchore](), [chainguard](), [container images](), [Security](), [vulnerability scanning]() Tags: [anchore](), [anchore-enterprise](), [chainguard](), [chainguard-containers](), [chainguard-partners](), [compliance](), [container-images](), [integration](), [scanners](), [secure-by-default](), [software-supply-chain-security](), [vulnerability-scanning]() ### AI overview Chainguard announces a new integration with Anchore Enterprise. The integration combines Chainguard's secure-by-default container images with Anchore's SBOM management, vulnerability scanning, and automated compliance policy enforcement to support continuous software security and compliance. ### Source excerpt Discover more about Chainguard's new integration with Anchore Enterprise. ## Introducing Scanfrog: Dodge Container Vulnerabilities DevFeed: [Introducing Scanfrog: Dodge Container Vulnerabilities]() Original publisher: [Read original article]() Published: 2025-07-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [vulnerability scanning](), [vulnerability management](), [grype](), [chainguard](), [chainguard containers](), [Security](), [Terminal](), [arcade](), [Open Source]() Tags: [anchore](), [chainguard](), [chainguard-containers](), [container](), [container-image](), [container-image-vulnerabilities](), [container-images](), [containers](), [free](), [games](), [grype](), [management](), [open-source](), [scanfrog](), [security](), [terminal](), [vulnerabilities](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview Scanfrog is a Frogger-style terminal game that turns vulnerabilities found in a container image into game obstacles. It uses Grype, a free and open-source vulnerability scanner, to create levels based on vulnerability-scanning results and illustrates why reducing vulnerabilities improves software security. ### Source excerpt Scanfrog is a Frogger-style game created by one of Chainguard's engineers to showcase how difficult it can be to dodge vulnerabilities in containers. ## Chainguard Now Available on Microsoft Azure Marketplace; Scan Chainguard Container Images with Microsoft Defender for Cloud DevFeed: [Chainguard Now Available on Microsoft Azure Marketplace; Scan Chainguard Container Images with Microsoft Defender for Cloud]() Original publisher: [Read original article]() Published: 2025-07-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Azure](), [container images](), [container-security](), [vulnerability scanning](), [Microsoft]() Tags: [azure](), [azure-marketplace](), [chainguard](), [chainguard-containers](), [chainguard-images](), [ci-cd](), [container-images](), [container-security](), [defender](), [microsoft-defender](), [security](), [vulnerability-scanning]() ### AI overview Chainguard Containers is now available through the Microsoft Azure Marketplace, enabling Azure customers to adopt it within existing procurement, billing, deployment, and CI/CD workflows. Microsoft Defender for Cloud can also scan Chainguard container images for vulnerabilities, improving visibility and security across container environments. ### Source excerpt Chainguard is now listed on the Microsoft Azure Marketplace. In addition, Microsoft Defender for Cloud can now scan Chainguard container images. ## Snyk's Statement on the MITRE CVEs Program Funding Update DevFeed: [Snyk's Statement on the MITRE CVEs Program Funding Update]() Original publisher: [Read original article]() Author: Danny Allan Published: 2025-04-16T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Cybersecurity](), [Vulnerabilities](), [Resilience](), [Security & Privacy](), [Threat Research]() Tags: [2025](), [awareness](), [blog](), [community](), [cves](), [cybersecurity](), [executive](), [global](), [government](), [resilience](), [security](), [snyk](), [snyk-platform](), [vulnerabilities](), [vulnerability](), [vulnerability-data](), [vulnerability-insights](), [vulnerability-scanning]() ### AI overview Snyk responds to uncertainty about federal funding for MITRE's CVE program and reports that its services and vulnerability data are not immediately affected. The statement emphasizes Snyk's independently curated vulnerability database, its ability as a CVE Numbering Authority to assign CVEs, and its willingness to collaborate on sustaining vulnerability infrastructure. ### Source excerpt Snyk addresses the recent MITRE CVE funding news, detailing our independent vulnerability data capabilities & commitment to cybersecurity resilience. ## FedRAMP vulnerability scanning requirements explained DevFeed: [FedRAMP vulnerability scanning requirements explained]() Original publisher: [Read original article]() Author: Can secure-by-default container images or VMs speed up FedRAMP authorization Published: 2024-11-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability scanning](), [Vulnerabilities](), [Security](), [configuration](), [Containers]() Tags: [audits](), [authorization](), [automated](), [common-vulnerabilities-and-exposures](), [compliance](), [container-images](), [containers](), [cve](), [fedramp](), [fips](), [requirements](), [security](), [stigs](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains FedRAMP vulnerability scanning requirements, including the required scan scope, recurring authenticated scans, reporting expectations, remediation timelines, and the role of scan data in continuous monitoring, authorization evidence, POA&Ms, and risk reviews. ### Source excerpt Understand FedRAMP vulnerability scanning rules, scope, and SLAs. Get compliance clarity and learn how to simplify audits. ## Snyk Code now secures AI builds with support for LLM sources DevFeed: [Snyk Code now secures AI builds with support for LLM sources]() Original publisher: [Read original article]() Author: Liqian Lim (林利蒨); Ranko Cupovic Published: 2024-06-25T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [snyk-code](), [Security](), [vulnerability scanning](), [Large Language Model](), [Vulnerabilities](), [AI Development](), [Code]() Tags: [acquisition](), [ai](), [blog](), [code-security](), [coding](), [convert-paid](), [developer](), [devops](), [executive](), [interest](), [llms](), [pmm](), [security](), [snyk](), [snyk-code](), [vulnerabilities](), [vulnerability-scanning]() ### AI overview Snyk Code has been updated to treat data returned by supported LLM libraries as untrusted sources. It performs taint analysis across data flows, detects unsanitized data reaching sensitive functions or stores, and alerts developers to potential security issues in AI-enabled applications. ### Source excerpt Snyk Code can now protect the use of supported LLM libraries in source code to detect any security issues and promptly alert users. Book a live demo. ## Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities DevFeed: [Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities]() Original publisher: [Read original article]() Published: 2024-06-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Security](), [chainguard](), [NVD](), [chainguard images](), [container images](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-list](), [cves](), [nvd](), [open-source-software](), [remote-code-execution-vulnerability](), [research](), [sca](), [security](), [software-composition-analysis](), [vulnerabilities](), [vulnerability-fix](), [vulnerability-scanning](), [wolfi]() ### AI overview An analysis of more than 600 Wolfi-packaged projects found over 100 security fixes without associated CVEs. Because vulnerability scanners and SCA tools rely on vulnerability databases such as the NVD, organizations may miss fixes unless they keep software updated. ### Source excerpt Are your vulnerability scanners missing critical security flaws? Discover how Chainguard's research reveals hundreds of vulnerabilities hiding in plain sight. ## Unlocking Chainguard's container security solutions DevFeed: [Unlocking Chainguard's container security solutions]() Original publisher: [Read original article]() Published: 2024-03-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container-security](), [container images](), [vulnerability management](), [Docker Hardened Images](), [vulnerability scanning](), [supply-chain-security](), [Monitoring]() Tags: [chainguard](), [chainguard-images](), [container-image](), [container-images](), [container-security](), [cve](), [cve-fatigue](), [hardened-images](), [security](), [software-supply-chain-security](), [vulnerabilities](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article discusses Chainguard's approach to container security, focusing on minimal hardened container images, SBOMs, signatures, vulnerability scanning, continuous monitoring, and updates. It also considers the operational trade-offs between building container images internally and using managed solutions. ### Source excerpt Uncover insights on whether to build or buy in container lifecycle management with tips from Chainguard, balancing security and operational needs. ## Strengthening your software supply chain security DevFeed: [Strengthening your software supply chain security]() Original publisher: [Read original article]() Published: 2024-01-08T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Software](), [Vulnerabilities](), [chainguard images](), [container images](), [sigstore](), [snyk]() Tags: [chainguard](), [container-images](), [containers](), [cve](), [dependency](), [grype](), [image](), [reproducible-builds](), [sbom](), [security](), [sigstore](), [slsa](), [snyk](), [software](), [solarwinds](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-scanning](), [wolfi]() ### AI overview This article explains software supply chain risks from open-source and third-party components, using the SolarWinds attack as an example. It recommends verifying artifacts, signing container images, minimizing dependencies, updating software, scanning for vulnerabilities, using smaller base images, adopting reproducible builds, and increasing SLSA maturity. ### Source excerpt Secure your codebase with advanced supply chain security tactics: artifact authentication, minimal images and more from Chainguard. ## How a false negative obscured CVE-2023-2454 in a PostgreSQL image DevFeed: [How a false negative obscured CVE-2023-2454 in a PostgreSQL image]() Original publisher: [Read original article]() Published: 2023-10-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [Vulnerabilities](), [chainguard images](), [trivy](), [PostgreSQL]() Tags: [chainguard-images](), [container-security](), [cve-2023-2454](), [false-negative](), [postgresql](), [trivy](), [vulnerability](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article explains how insufficient vulnerability database metadata can cause a scanner to miss CVE-2023-2454 in a PostgreSQL image. It presents Chainguard Images as often containing fixes for vulnerabilities that scanners miss. ### Source excerpt Unearth a haunting tale of overlooked threats in scanning. Discover how Chainguard Images counteract gaps, ensuring robust defense against CVEs. ## Streamline dependency updates with Mergify and Snyk DevFeed: [Streamline dependency updates with Mergify and Snyk]() Original publisher: [Read original article]() Author: Liran Tal Published: 2023-08-23T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Dependency management](), [Automation](), [GitHub](), [pull-requests](), [ci](), [Code review](), [Security](), [vulnerability scanning](), [snyk](), [snyk-open-source]() Tags: [acquisition](), [application-security](), [automation](), [blog](), [ci](), [code-review](), [dependabot](), [dependency](), [developer](), [devops](), [devrel](), [github](), [open-source-security](), [security](), [snyk-open-source](), [vulnerability-scanning]() ### AI overview This article explains how Mergify and Snyk can automate dependency update workflows. Snyk identifies dependency updates and creates GitHub pull requests, while Mergify can automate pull request review and merging based on defined conditions, helping teams keep dependencies current and address security fixes with less manual work. ### Source excerpt Automate dependency updates with Mergify and Snyk. ## Fuzzy CVEs, tarfiles, and untrusted input DevFeed: [Fuzzy CVEs, tarfiles, and untrusted input]() Original publisher: [Read original article]() Published: 2023-07-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Vulnerabilities](), [common vulnerabilities and exposures](), [Python](), [Open Source](), [Maintainers](), [NVD]() Tags: [common-vulnerabilities-and-exposures](), [cve](), [cves](), [cybersecurity](), [go](), [maintainers](), [nvd](), [open-source](), [python](), [scanner](), [scanners](), [software-supply-chain](), [vulnerability-scanner](), [vulnerability-scanning](), [wolfi]() ### AI overview This article examines CVE-2007-4559 in Python's tarfile module, why the 15-year-old issue may still appear in security scanners, and why its classification as a vulnerability is disputed. It discusses CVE processes, NVD entries, open-source maintainer constraints, and the risks of extracting untrusted tarfile inputs. ### Source excerpt Navigate fuzzy CVEs, tarfiles, and untrusted input with Chainguard, paving the way to secure coding practices. ## How Chainguard fixes vulnerabilities before they're detected DevFeed: [How Chainguard fixes vulnerabilities before they're detected]() Original publisher: [Read original article]() Published: 2023-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Vulnerabilities](), [Go](), [Security](), [Software](), [Pull Request](), [HTTP](), [releases](), [cloud-infrastructure](), [OAI-PMH]() Tags: [automated](), [base-images](), [build](), [chainguard](), [cve](), [go](), [http](), [image-cves](), [library](), [net](), [repo](), [scanner](), [scanners](), [security](), [vulnerabilities](), [vulnerability](), [vulnerability-management](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard describes how Wolfi rapidly remediated CVE-2023-29406 in Go by automating upstream release monitoring, package rebuilding, testing, review, and release. The article explains that the fix reached Wolfi-packaged Go applications before vulnerability scanners had the information needed to detect it, and that the updated Go image and dependent packages were rebuilt to include the fix. ### Source excerpt Uncover Chainguard's strategic vulnerability remediation, enhancing your software's security posture. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## Fortify, comply and conquer FedRAMP with Chainguard Images DevFeed: [Fortify, comply and conquer FedRAMP with Chainguard Images]() Original publisher: [Read original article]() Published: 2023-05-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [vulnerability scanning](), [container images](), [vulnerability](), [Security](), [supply-chain-security](), [Linux]() Tags: [chainguard-images](), [compliance](), [container-images](), [container-security](), [cve](), [fedramp](), [fips](), [hardened-image](), [linux](), [nist](), [secure-container-image](), [security](), [software-supply-chain](), [vulnerability](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains how Chainguard Images can help cloud service providers and federal agencies achieve or maintain FedRAMP authorization. It describes FedRAMP requirements for hardened container images, recurring vulnerability scanning, NVD identifiers, CVSSv3 scores, and vulnerability remediation tracking. It presents Chainguard Images as secure, continuously updated base images built from source on the hardened Wolfi Linux un-distribution. ### Source excerpt Learn how Chainguard Images can you achieve or maintain your FedRAMP compliance authorization with secure-by-default base images. ## Chainguard Image now available for prometheus DevFeed: [Chainguard Image now available for prometheus]() Original publisher: [Read original article]() Published: 2023-04-14T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Prometheus](), [Security](), [vulnerability](), [vulnerability scanning](), [Containers](), [Go](), [Documentation]() Tags: [chainguard](), [chainguard-images](), [configuration](), [cosign](), [cves](), [distroless](), [documentation](), [go](), [image](), [kubernetes](), [prometheus](), [prometheus-image](), [sboms](), [security](), [slsa](), [toolchain](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a Prometheus container image built on Wolfi with a minimal, distroless-style base, hardened toolchain, continuous patching, and fewer reported CVEs. The image includes a default configuration, source-built binaries, SBOMs, signatures, and provenance support. ### Source excerpt Check out the new Chainguard Image for Prometheus that is minimal in size and contains fewer CVEs than other alternatives. ## Chainguard Image now available for NATS DevFeed: [Chainguard Image now available for NATS]() Original publisher: [Read original article]() Published: 2023-03-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Messaging](), [chainguard images](), [Containers](), [chainguard](), [Security](), [vulnerability scanning]() Tags: [chainguard](), [chainguard-images](), [cli](), [containers](), [cosign](), [documentation](), [hardened-images](), [messaging](), [minimal-image](), [nats-image](), [provenance](), [sboms](), [secure-by-default](), [secure-images](), [slsa](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a hardened Chainguard Image for NATS, built on Wolfi for containerized workloads. The image includes a development variant with the nats CLI and nsc tool, is reported to be over 50% smaller than comparable options, targets zero known CVEs, and includes source-built binaries, SBOMs, signatures, and provenance information. ### Source excerpt Learn about our hardened Chainguard Image for NATS, which is built on Wolfi, our secure by default operating system for containerized workloads. ## Chainguard Image now available for Apache Zookeeper DevFeed: [Chainguard Image now available for Apache Zookeeper]() Original publisher: [Read original article]() Published: 2023-03-20T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Containers](), [Security](), [vulnerability scanning](), [GitHub]() Tags: [apache-zookeeper](), [built-from-source](), [chainguard](), [chainguard-images](), [container-image](), [containers](), [cosign](), [docker-zookeeper](), [jdk](), [kafka-zookeeper](), [minimal-image](), [provenance](), [secure-images](), [vulnerability-scanning](), [wolfi](), [zookeeper-container](), [zookeeper-image]() ### AI overview Chainguard announces a new Chainguard Image for Apache Zookeeper. Built from source with Wolfi and Chainguard's OpenJDK JRE, the minimal image is hardened for non-root operation and a locked-down filesystem, and is presented as more than 50% smaller than alternatives. ### Source excerpt New Chainguard Image for Apache Zookeeper is over 50% smaller in size compared to alternatives. Powered by Wolfi, comes with our own JDK, and built from source. ## A purl of wisdom on SBOMs and vulnerabilities DevFeed: [A purl of wisdom on SBOMs and vulnerabilities]() Original publisher: [Read original article]() Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [Vulnerabilities](), [supply-chain-security]() Tags: [chainguard-images](), [component](), [components](), [container-images](), [false-positive](), [nvd](), [package-url](), [purl](), [sbom](), [sboms](), [scanner](), [software-bill-of-materials](), [software-supply-chain](), [vulnerabilities](), [vulnerability-data](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%. ### Source excerpt SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%. [Next page]()