README

[![GitHub Release][release-img]][release]
[![Test][test-img]][test]
[![Go Report Card][go-report-img]][go-report]
[![License: Apache-2.0][license-img]][license]
[![GitHub Downloads][github-downloads-img]][release]
![Docker Pulls][docker-pulls]

[📖 Documentation][docs]


Trivy ([pronunciation][pronunciation]) is a comprehensive and versatile security scanner.
Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes

Scanners (what Trivy can find there):

- OS packages and software dependencies in use (SBOM)
- Known vulnerabilities (CVEs)
- IaC issues and misconfigurations
- Sensitive information and secrets
- Software licenses

Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the [Scanning Coverage] page.

To learn more, go to the [Trivy homepage][homepage] for feature highlights, or to the [Documentation site][docs] for detailed information.

 Quick Start

 Get Trivy

Trivy is available in most common distribution channels. The full list of installation options is available in the [Installation] page. Here are a few popular examples:

- brew install trivy
- docker run aquasec/trivy
- Download binary from 
- See [Installation] for more

Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the [Ecosystem] page. Here are a few popular examples:

- GitHub Actions
- Kubernetes operator
- VS Code plugin
- See [Ecosystem] for more

 Canary builds
There are canary builds (Docker Hub, GitHub, ECR images and binaries) generated with every push to the main branch.

Please be aware: canary builds might have critical bugs, so they are not recommended for use in production.

 General usage

bash
trivy  [--scanners ] 


Examples:

bash
trivy image python:3.4-alpine



Result

https://github.com/user-attachments/assets/af1c11e7-d9c5-48af-8e05-cb34dfd6352a



bash
trivy fs --scanners vuln,secret,misconfig myproject/



Result

https://github.com/user-attachments/assets/6b3894b7-77c5-4ffc-ac94-ffe6648a30dc



bash
trivy k8s --report summary cluster



Result

!k8s summary



 FAQ

 How to pronounce the name "Trivy"?

tri is pronounced like trigger, vy is pronounced like envy.

 Want more? Check out Aqua

If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.  
You can find a high level comparison table specific to Trivy users here.
In addition check out the  website for more information about our products and services.
If you'd like to contact Aqua or request a demo, please use this form: 

 Community

Trivy is an [Aqua Security][aquasec] open source project.  
Learn about our open source work and portfolio [here][oss].  
Contact us about any matter by opening a GitHub Discussion [h

Top issues

Discussions

Latest release

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

- Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
- golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
- github.com/go-jose/go-jose/v4 is bumped