Grype
7.4#2 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
Visit
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
You want what its maker publishes above — check its page for the details.