dockerscan

No entries match these filters. Clear filters

1. v2.1.0 Jul 13, 2026 · issue 023

   DockerScan v2.1.0 overhauls CVE detection with MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. cvelistV5 (~125K CVEs), dpkg-accurate version matching, and optional NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. enrichment.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.0 https://github.com/cr0hn/dockerscan.git
   # already have the repo? check out this version:
   $ git checkout v2.1.0

   └──▷ TRY IT
   Fetch the new ~125K-CVE database immediately after upgrading so scans reflect the MITRE cvelistV5 data.
   copy

   $ dockerscan update-db

   • Switches CVE database source to MITRE cvelistV5 daily snapshots, eliminating NVD API keys and rate limits while growing coverage from ~1,500 to ~125,000 CVEs.
   • Rewrites package-to-CVE matching with a dpkg-style version comparator (Debian Policy 5.6.12) and per-(vendor, product) version ranges for accurate results.
   • Adds vendor_verified metadata to findings, distinguishing vendor-confirmed matches from heuristic name-only matches (which now include explicit remediation caveats).
   • Adds optional, non-blocking CVSS enrichment from the NVD API via --enrich-from-nvd, --enrich-only, and --enrich-timeout flags — NVD downtime never fails the build.
   • Expands vendor-verified package alias coverage with 11 new entries (gnu/coreutils, gnu/tar, gnu/sed, gnu/grep, gnu/gzip, gnu/findutils, busybox, musl-libc/musl, and more).

   5 details in Everything

2. v2.0.6 Jun 11, 2026 · release notes

   dockerscan v2.0.6 adds Docker credential helpers and verbose/debug flags

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.6 https://github.com/cr0hn/dockerscan.git
   # already have the repo? check out this version:
   $ git checkout v2.0.6

   • --verbose / -v flag shows scan progress including scanner status, image pull details, and per-scanner findings count to stderr.
   • --debug flag enables verbose output plus internal errors from failed sub-checks in CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline., supply chain, and runtime scanners.
   • Docker credential helper support via credHelpers (per-registry) and credsStore (global) configs for helpers like docker-credential-osxkeychain, docker-credential-pass, and docker-credential-wincred.

   3 details in Everything

3. v2.0.0 Nov 27, 2025 · release notes

   DockerScan v2.0.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark, supply chain and secrets detection with SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./JSON output via --scanners flag

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/cr0hn/dockerscan.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   └──▷ USE IT
   Run only secrets and CIS checks on an image for faster CI feedback
   shell copy

   dockerscan --scanners cis,secrets myapp:v1.0

   • Adds --scanners CLI flag to select specific scanning modules (e.g., cis, secrets, vulnerabilities)
   • Adds SARIF output format for integration with GitHub Security, Azure DevOps, and VS Code
   • Adds JSON report output for machine-readable analysis results
   • Adds CIS Docker Benchmark v1.7.0 compliance checks covering host config, daemon hardening, and image best practices
   • Adds supply chain attack detection for imageless containers, crypto miners, backdoored libraries, and signature verification

   +2 more show less

   • Adds advanced secrets detection with 40+ patterns including AWS, GCP, Azure credentials, API keys, private keys, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. tokens, and DB connections
   • Adds runtime security analysis for Linux capabilities, Seccomp profiles, AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code., namespace analysis, and container escape detection

   7 details in Everything