SBOM-powered SCA platform for container & source code security scanning AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →
Tools & products
We build profiles from public sources and haven't extracted a capability list for Anchore. Closest sources we do hold:
Showing the 12 closest of 29 — see all.
Integrates with: Cisco ↗, Embed Security ↗, GitHub ↗, GitLab ↗, Google ↗, Infoblox ↗, JFrog ↗, Microsoft ↗
2 of 5 independent trust signals established
Anchore has 2 dimensions with established evidence. The rest have not been confirmed yet.
Not yet established: Independently verified · Behaviour under stress · Disclosure posture
Has anyone other than the vendor confirmed this?
Nothing here has been confirmed by an independent third party yet.
Is this a real, durable business?
How long this vendor has been operating, and who stands behind them.
Security headers (4/5) — checked 10/18/2026
Infrastructure & transparency signals
1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Ancho…
Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQ…
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Datasheets, whitepapers, and case studies found on anchore.com by the enrichment loop. Links open the original documents on the vendor's own site.
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →
Integrated by: Black Duck, Echo, HeroDevs, Konvu
What do they do when something goes wrong?
What their public record shows about handling vulnerabilities and outages.
Do they tell you the awkward things unprompted?
How much this vendor volunteers before you have to ask.
Are they still shipping, or coasting?
Whether this vendor is visibly still building.
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchor…
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows…
Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be…
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used…
Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site s…
Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable…
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the…
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an imag…
Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm…
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permis…
Anyone can push out code quickly. Can they push secure code with the highest confidence that it fits the risk profiles of critical national infrastructure like financial services?
Anchore was one of the first tools that we brought on. It was recommended by our CISO who has been deeply involved in the security community for decades
I can’t emphasize enough, there is a ton of scrutiny around security—especially around our containers. We deploy into large banks and financial institutions worldwide. You can imagine the security involved with these types of deployments. Anchore is a key component in making these deployments successful
Anyone can push out code quickly. Can they push secure code with the highest confidence that it fits the risk profiles of critical national infrastructure like financial services?
Anchore was one of the first tools that we brought on. It was recommended by our CISO who has been deeply involved in the security community for decades
I can’t emphasize enough, there is a ton of scrutiny around security—especially around our containers. We deploy into large banks and financial institutions worldwide. You can imagine the security involved with these types of deployments. Anchore is a key component in making these deployments successful
We include AnchoreCTL in an image and use that image to run the scanning and analysis steps. We do that so we can keep all the connections inside of the cluster without having to SSH into an already running pod
Before Anchore, it would take us a week to two weeks to go through everything that an image could have—we’d have to first build the actual software on the image and then go through all the different connection points and dependencies. Using Anchore has brought that down to a 3-day review time
The idea is that you can replace your static contract deliverables with dynamic ones -doing review meetings based on Anchore’s live data instead of ‘here’s my written report that took me a week to write up on what we found last week,’ and by the time the government gets it, it’s now 2-3 weeks old
When I first started, I was manually searching GitHub repos for references to vulnerable libraries but it was impossible to tell whether the codebase was a test repo, staging or not even in use. Anchore’s SBOM inventory gave us certainty that a vulnerability was actually in production and needed to be fixed
We’re not trying to waste our team or other team’s time. We don’t want to report vulnerabilities that don’t exist. A low false-positive rate is paramount. FedRAMP is very stringent and we don’t want to create more work for ourselves given our limited resources
We effectively had no tooling before Anchore. Everything was manual. We reduced the amount of time on vulnerability detection tasks by 75%
