Best Software Composition Analysis Software in 2026 · page 2

Anchore Enterprise

FossID Workbench

FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.

JFrog Xray

JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…

MergeBase

OSS Review Toolkit

Automates dependency review with policy checks for licenses, vulnerabilities, and engineering standards.

OWASP dep-scan

Reviews repositories, Kubernetes manifests, and Linux images for CVEs, advisories, and license limits.

OWASP Dependency-Track

Uses CycloneDX documents to track components, match vulnerability data, and prioritize mitigation.

Vulert

OpenHack Supply Chain

Bomly CLI

Bomly CLI scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.

bundler-audit

Verifies Bundler projects against vulnerable gem versions and flags HTTP or Git gem sources.

CVE Binary Tool

Finds vulnerable components in software and can read or create several SBOM formats.

Insignary Clarity

OSV-Scanner

OSV-Scanner is a free tool for finding known vulnerabilities in project dependencies against the OSV database.

Black Duck SCA

Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code.

cargo-audit

Clair

Clair is a free, open-source service that scans container images for vulnerabilities in base operating systems, installed packages, and programming language components.

Lineaje SCA360

Lineaje SCA360 is a web-based cloud product for analyzing software supply chain security risks across development stages.

govulncheck

lockhawk

Builds dependency trees from JavaScript lockfiles and checks packages against OSV.dev.

cargo-deny

Checks Rust dependency graphs for advisories, license requirements, banned crates, and trusted sources.

depproof

Resolves transitive dependencies and checks four language ecosystems for vulnerabilities and license obligations.

pip-audit

Checks Python dependencies against PyPI or OSV and can upgrade vulnerable packages.

Sandworm Audit

SBOM Studio

SBOM Studio is a cloud, web-based enterprise platform for managing software bills of materials and supply-chain risk across a product lifecycle.