Grype finds known vulnerabilities (CVEs) in the software installed on each host. It first builds a complete inventory of installed packages, known as a software bill of materials (SBOM), and then checks each package against a vulnerability database.
Supports: NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning), SI-2 (Flaw Remediation), and CM-8 (System Component Inventory).
What you get
- One finding per vulnerability match, rated with Grype’s own severity.
- A package inventory in the scan summary, showing the total package count, the count by package type, and the detected Linux distribution.
Known exploited vulnerabilities
Every match is checked against the CISA Known Exploited Vulnerabilities (KEV) catalog, which is included with each Reef release. Vulnerabilities on the KEV list are actively exploited in the wild, so Reef puts them first:
- KEV findings appear at the top of the findings list regardless of their severity rating, with a highlight and a KEV badge.
- The dashboard shows a KEV count tile.
- The Findings page can show only KEV findings.
- Each KEV finding includes the catalog entry, such as the required action and CISA’s due date.
This makes it easy to prioritize remediation under BOD 22-01 or any policy that treats known exploitation as urgent.
CVSS scores
When Grype doesn’t supply a CVSS score for a CVE, Reef fills it in from the National Vulnerability Database (NVD). It uses the newest CVSS version available. Each finding links directly to its NVD entry.
Options
| Key | Default | Effect |
|---|---|---|
target |
dir:/host |
What to scan. You can also scan a container image (for example, registry:… or an image reference) or an existing SBOM (sbom:/path). |
sbom |
None | The path to an existing SBOM to scan instead of building a new one. |
exclude |
Built-in list | Paths to skip, written as ./-relative patterns. This replaces the default list. |
no_excludes |
false |
Scan everything, including caches and build folders that are normally skipped. |
Very large hosts
On a host with a very large number of packages, Reef may trim descriptive text from the results to keep them a manageable size. The vulnerability matches themselves are kept. If a result is incomplete, Reef marks that scan as partial and does not close any existing findings based on it. For more detail, see Findings.
Resource use
Grype’s vulnerability database is about 1 to 2 GB. The agent keeps it between scans, so it is not downloaded again each time, and it updates automatically, which requires outbound internet access. Temporary scan files are held in memory up to the REEF_SCAN_TMP_SIZE limit (2 GB by default). If a scan needs more than that, it fails cleanly without filling the host’s disk.