Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
trivy — Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | Kitploit
Tools/GitHubGitHub/aquasecurity/trivy
Cloud Infrastructure SecurityDefensive ToolsVulnerability ScannersContainer SecurityStatic Code Analysis (SAST)Vulnerability AnalysisCode AnalysisServerless SecurityConfiguration AuditingNetwork SecurityCloud SecurityDevSecOps
37.4k583381 day agoReviewed by Kitploit
Secret Detection
Supply Chain Security
Misconfiguration
Container Escape
Database Security
Top in Cloud Infrastructure Security #13
Top in Cloud Security #3
Top in Code Analysis #17
Top in Configuration Auditing #4
Top in Container Escape #16
Top in Container Security #1
Top in Database Security #9
Top in Defensive Tools #8
Top in DevSecOps #1
Top in Misconfiguration #4
Top in Network Security #11
Top in Secret Detection #9
Top in Serverless Security #5
Top in Static Code Analysis (SAST) #14
Top in Supply Chain Security #2
Top in Vulnerability Analysis #4
Top in Vulnerability Scanners #4
GitHubaquasecurity/trivy

trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

View RepositoryWebsite

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

GitHub Release Test Go Report Card License: Apache-2.0 GitHub Downloads Docker Pulls

📖 Documentation

Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

  • Container Image
  • Filesystem
  • Git Repository (remote)
  • Virtual Machine Image
  • Kubernetes

    • Scanners (what Trivy can find there):

    • OS packages and software dependencies in use (SBOM)
    • Known vulnerabilities (CVEs)
    • IaC issues and misconfigurations
    • Sensitive information and secrets
    • Software licenses

    Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.

    To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.

    Quick Start

    Get Trivy

    Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

    • brew install trivy
    • docker run aquasec/trivy
    • Download binary from https://github.com/aquasecurity/trivy/releases/latest/
    • See Installation for more

    Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:

    • GitHub Actions
    • Kubernetes operator
    • VS Code plugin
    • See Ecosystem for more

    Canary builds

    There are canary builds (Docker Hub, GitHub, ECR images and binaries) generated with every push to the main branch.

    Please be aware: canary builds might have critical bugs, so they are not recommended for use in production.

    General usage

    root@kitploit:~
    trivy <target> [--scanners <scanner1,scanner2>] <subject>

    Examples:

    root@kitploit:~
    trivy image python:3.4-alpine
    Result

    https://github.com/user-attachments/assets/af1c11e7-d9c5-48af-8e05-cb34dfd6352a

    root@kitploit:~
    trivy fs --scanners vuln,secret,misconfig myproject/
    Result

    https://github.com/user-attachments/assets/6b3894b7-77c5-4ffc-ac94-ffe6648a30dc

    root@kitploit:~
    trivy k8s --report summary cluster
    Result

    k8s summary

    FAQ

    How to pronounce the name "Trivy"?

    tri is pronounced like trigger, vy is pronounced like envy.

    Want more? Check out Aqua

    If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.
    You can find a high level comparison table specific to Trivy users here. In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo

    Community

    Trivy is an Aqua Security open source project.
    Learn about our open source work and portfolio here.
    Contact us about any matter by opening a GitHub Discussion here

    Please ensure to abide by our Code of Conduct during all interactions.

    Download Tool