#1
Cupdate auto-detects container images in Kubernetes, Docker or Podman, finds newer versions and exposes results via a UI, API and RSS feed with vulnerability metadata.
311 stars8 forksMITlast commit Actively maintained
2 self-hosted JFrog Xray alternatives
JFrog Xray is a software composition analysis (SCA) service that scans packages, binaries, container images and build artifacts for vulnerabilities, license and compliance risks. It performs deep recursive scans, produces SBOMs, enforces policies, and integrates with CI/CD and artifact repositories.
Alternatives to JFrog Xray
#2
Secrover generates human-readable HTML security audit reports for repositories and domains. Scans dependencies, code, and domains; supports scheduling and remote exports.
252 stars3 forksGPL-3.0last commit Actively maintained
What replacing JFrog Xray actually involves
Every option on this page is open source and free to run on your own hardware, so you own the data and there is no subscription to cancel. 2 of 2 shipped a commit in the last six months. Licences in this list: MIT, GPL-3.0. In exchange you take on hosting, backups and updates yourself.
Browse everything in Vulnerability Management, Compliance & Audit.
