SBOM Generator and CVE Matcher

---
name: sbom-generator-and-cve-matcher-5f0fff12fde0
slug: "sbom-generator-cve-matcher"
description: "Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance."
github_stars: 8853
verification: "security_reviewed"
source: "https://github.com/anchore/syft"
author: "anchore"
category: "Security & Verification"
framework: "Codex"
tool_ecosystem:
  github_repo: "anchore/syft"
  github_stars: 8853
---

# SBOM Generator and CVE Matcher

Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance.

## Installation

Requirements and caveats from upstream:
- Supports dozens of packaging ecosystems (e.g. Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and [many more](https://oss.anchore.com/docs/capabilities/all-packages/))
- Supports OCI, Docker, [Singularity](https://github.com/sylabs/singularity), and [more image formats](https://oss.anchore.com/docs/guides/sbom/scan-targets/)
- **See [Installation docs](https://oss.anchore.com/docs/installation/syft/) for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!**

Basic usage or getting-started notes:
- **New to Syft? Check out the [Getting Started guide](https://oss.anchore.com/docs/guides/sbom/getting-started/) for a walkthrough!**
- The quickest way to get up and going:
- bash

- Source: https://github.com/anchore/syft
- Extracted from upstream docs: https://raw.githubusercontent.com/anchore/syft/HEAD/README.md

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/sbom-generator-cve-matcher/)