# grype Grype is a vulnerability scanner for container images and filesystems that also scans SBOMs for known vulnerabilities. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Is Grype a single point of failure for Chainguard's CVE detection? DevFeed: [Is Grype a single point of failure for Chainguard's CVE detection?]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [chainguard](), [Malware](), [chainguard containers](), [Open Source](), [Containers]() Tags: [chainguard](), [chainguard-containers](), [chainguard-os](), [chainguard-scanners](), [containers](), [cve](), [grype](), [malware](), [open-source](), [source](), [supply-chain-attacks](), [trivy]() ### AI overview The article explains why Grype is not a single point of failure in Chainguard's CVE detection system. It describes layered defenses including building Grype from source, malware detection, and alternative input-source protections to improve the reliability of security findings. ### Source excerpt Is Grype a single point of failure? Learn how Chainguard uses layered defenses, source builds, and multiple data sources to ensure trusted CVE detection. ## How Chainguard Automated Detection and Patching of a High-Severity CVE DevFeed: [How Chainguard Automated Detection and Patching of a High-Severity CVE]() Original publisher: [Read original article]() Published: 2026-02-13T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [vulnerability](), [anchore](), [grype](), [ci](), [GitHub](), [Pull Request]() Tags: [2025](), [anchore](), [chainguard](), [chainguard-containers](), [chainguard-cve-remediation](), [chainguard-factory](), [chainguard-images](), [ci](), [container-images](), [cve](), [github](), [grype](), [pull-request](), [security](), [vulnerability](), [zero-cves]() ### AI overview The article describes how Chainguard's Factory detected a high-severity vulnerability affecting k9s, updated Grype, opened and merged a pull request, and published a fixed package within 46 hours of the advisory. It also reports that Chainguard remediated 2,960 unique CVEs in November 2025 while meeting its stated remediation SLA. ### Source excerpt The Chainguard Factory and DriftlessAF automate CVE detection and patching, delivering fixes in hours and maintaining industry-leading remediation SLAs. ## Introducing Scanfrog: Dodge Container Vulnerabilities DevFeed: [Introducing Scanfrog: Dodge Container Vulnerabilities]() Original publisher: [Read original article]() Published: 2025-07-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [vulnerability scanning](), [vulnerability management](), [grype](), [chainguard](), [chainguard containers](), [Security](), [Terminal](), [arcade](), [Open Source]() Tags: [anchore](), [chainguard](), [chainguard-containers](), [container](), [container-image](), [container-image-vulnerabilities](), [container-images](), [containers](), [free](), [games](), [grype](), [management](), [open-source](), [scanfrog](), [security](), [terminal](), [vulnerabilities](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview Scanfrog is a Frogger-style terminal game that turns vulnerabilities found in a container image into game obstacles. It uses Grype, a free and open-source vulnerability scanner, to create levels based on vulnerability-scanning results and illustrates why reducing vulnerabilities improves software security. ### Source excerpt Scanfrog is a Frogger-style game created by one of Chainguard's engineers to showcase how difficult it can be to dodge vulnerabilities in containers. ## Guardcraft: A Minecraft Java Server with Zero CVEs DevFeed: [Guardcraft: A Minecraft Java Server with Zero CVEs]() Original publisher: [Read original article]() Published: 2025-02-28T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Docker](), [Containers](), [Vulnerabilities](), [grype](), [Docker Hub](), [Security](), [Ubuntu](), [Linux](), [Steam Deck]() Tags: [bedrock](), [chainguard](), [chainguard-containers](), [chainguard-images](), [container](), [container-image](), [containers](), [docker](), [docker-hub](), [grype](), [guardcraft](), [linux](), [security](), [steam-deck](), [vulnerabilities](), [zero-cves]() ### AI overview The article describes building a Minecraft Java server with a Chainguard Image. It compares a popular Ubuntu-based Docker Hub image with the Chainguard approach, highlighting the former's 165 unresolved CVEs and the latter's stated result of zero CVEs. ### Source excerpt We built a Minecraft Java server using a Chainguard Image, resulting in zero CVEs and a whole lot of fun! ## Can auto-patched container images pass the zero CVE challenge? DevFeed: [Can auto-patched container images pass the zero CVE challenge?]() Original publisher: [Read original article]() Published: 2024-07-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Vulnerabilities](), [chainguard images](), [grype](), [trivy](), [Security](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container](), [container-images](), [grype](), [security](), [trivy](), [vulnerabilities]() ### AI overview This article examines whether auto-patching can reduce vulnerabilities in container images. An experiment involving 20 popular images found that copacetic reduced CVEs by an average of 8%, while manually updating packages reduced them by 9%. Chainguard Images reduced CVEs by 99% in the reported comparison. ### Source excerpt Discover how Chainguard surpasses copacetic in the zero-CVE challenge. Ensure vulnerability-free deployments with our Chainguard Images. ## How much time is wasted triaging known exploits? DevFeed: [How much time is wasted triaging known exploits?]() Original publisher: [Read original article]() Published: 2024-06-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability management](), [Vulnerabilities](), [Exploit](), [chainguard images](), [container images](), [grype](), [chainguard]() Tags: [base-container-images](), [chainguard-images](), [container-image](), [container-images](), [cve](), [cve-management](), [cves](), [efficiency](), [exploited-vulnerabilities](), [exploits](), [grype](), [kev-catalog](), [known-exploited-vulnerability](), [nvd-cve](), [vulnerability](), [vulnerability-detection](), [vulnerability-management](), [zero-cves]() ### AI overview The article reports that seven percent of 230 popular Bitnami container images contained CVEs listed in the Known Exploited Vulnerability catalog, but detailed triage found that none were exploitable in those container contexts. It argues that CVE triage consumes substantial staff time, while Chainguard Images historically remediated affected CVEs in an average of 2.5 days. ### Source excerpt Stop wasting time on known exploits. Read our latest research and discover strategies to streamline your vulnerability management for maximum efficiency. ## Building minimal and low CVE images for Java DevFeed: [Building minimal and low CVE images for Java]() Original publisher: [Read original article]() Published: 2024-06-11T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Java](), [Security](), [Dockerfile](), [Maven](), [grype](), [Spring Boot](), [Docker](), [Docker Hub]() Tags: [chainguard](), [chainguard-images](), [cves](), [docker](), [docker-hub](), [grype](), [java](), [java-migration](), [security](), [spring-boot](), [tooling]() ### AI overview This article demonstrates how to build smaller, lower-CVE container images for Java applications with Chainguard Images. It compares a Maven-based Docker image with a Chainguard equivalent, then uses a multi-stage build to remove build tooling and source code from the production image. ### Source excerpt Build secure, minimal Java images with fewer CVEs. Learn how Chainguard Images helps you optimize security and performance for your Java applications. ## The story of the most vulnerable Chainguard Image DevFeed: [The story of the most vulnerable Chainguard Image]() Original publisher: [Read original article]() Published: 2024-04-01T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container images](), [Vulnerabilities](), [grype]() Tags: [chainguard](), [chainguard-images](), [common-exposures-and-vulnerabilities](), [container-images](), [cve](), [grype](), [release](), [vulnerabilities]() ### AI overview Chainguard humorously announces a deliberately insecure Chainguard Image containing nearly 300,000 known vulnerabilities according to Grype. The article contrasts it with the company's hardened images and warns readers not to use the vulnerable image in production or near clusters. ### Source excerpt Chainguard jokingly revels its 'most vulnerable' Image with 300,000 CVEs as an April Fools' joke, showcasing just how many CVEs they protect against. ## Can debloated containers pass the zero CVE test? DevFeed: [Can debloated containers pass the zero CVE test?]() Original publisher: [Read original article]() Published: 2023-11-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [Vulnerabilities](), [Security](), [container images](), [chainguard images](), [grype](), [chainguard]() Tags: [container-images](), [containers](), [cve](), [cves](), [grype](), [hardened-images](), [hardening](), [security](), [software-supply-chain-security-research](), [vulnerabilities](), [zero-cves]() ### AI overview The article analyzes 28 debloated container images and finds that they reduce CVEs by an average of 64% compared with baseline images, but still contain an average of 33 CVEs. It also reports an average of five high or critical vulnerabilities, concluding that debloated containers do not pass the zero-CVE test. The comparison uses Grype and includes Chainguard Images versions. ### Source excerpt Exploring the efficiency of debloated containers in the Zero CVE test: Chaingaurd's analysis of security and efficiency. ## Grype Adds OpenVEX Support for Vulnerability Analysis DevFeed: [Grype Adds OpenVEX Support for Vulnerability Analysis]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [openvex](), [supply-chain-security](), [vulnerability management](), [anchore](), [chainguard](), [Security]() Tags: [anchore](), [chainguard](), [cve](), [cybersecurity-and-infrastructure-security-agency](), [grype](), [openssf](), [openvex](), [scanner](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [vex](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview Grype, Anchore's open-source vulnerability scanner, now supports OpenVEX, a machine-readable standard for vulnerability analysis. The article explains how this can provide context for vulnerabilities and help reduce false positives and vulnerability-management effort. ### Source excerpt Open source vulnerability scanner Grype has added support for OpenVEX, making software supply chain security easier. Learn how to implement it today. ## Why Chainguard uses Grype as its first line of defense for CVEs DevFeed: [Why Chainguard uses Grype as its first line of defense for CVEs]() Original publisher: [Read original article]() Published: 2023-10-06T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [chainguard](), [Vulnerabilities](), [Security](), [Open Source](), [chainguard images](), [container images](), [Go](), [trivy]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve-remediation](), [cves](), [false-negative](), [false-positive](), [go](), [grype](), [open-source](), [prisma-cloud](), [sbom](), [security](), [snyk](), [trivy](), [vex]() ### AI overview Chainguard explains why it selected Grype as the foundation of its internal vulnerability detection system. The article describes scanning early in the software delivery pipeline, using Grype as a Go library to scan Wolfi APK packages before container images are built, and contributing vulnerability data and improvements to the open-source project. It also briefly compares Grype's open data pipeline with Trivy's. ### Source excerpt Chainguard harnesses Grype's open-source power to ensure minimal CVEs in images, prioritizing user security. ## The zero CVE challenge: Can official Docker Hub images pass the test? DevFeed: [The zero CVE challenge: Can official Docker Hub images pass the test?]() Original publisher: [Read original article]() Published: 2023-08-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Docker](), [Docker Hub](), [container-security](), [Vulnerabilities](), [Debian](), [Containers](), [grype]() Tags: [container-security](), [cve](), [cves](), [debian](), [docker](), [docker-hub](), [docker-hub-image](), [docker-images](), [grype](), [image-cves](), [security](), [software](), [vulnerabilities]() ### AI overview An analysis of ten widely used official Docker Hub images found that updating all operating-system packages reduced vulnerability counts by less than 6% on average. Approximately 98% of the vulnerabilities were associated with Debian-based packages, and the average image still had 225 vulnerabilities after updates. ### Source excerpt Uncover the findings of the Zero CVE Challenge on Official Docker Hub Images, a step towards secure containerization.