Comment by jungturk
5 hours ago
Lots of licensed solutions have this (typically SAST or DAST tooling like Snyk, etc...). Given your build manifest/SBOM they cross-reference CVEs for vulnerabilities during/after build time.
Some have free licenses, many don't.
There are also better tools like Sysdig, Twistlock, etc. which scan containers at runtime for CVEs.
Sometimes build time is too slow (e.g., a repo that doesn't receive updates every day or so).