Trivy

Trivy is a comprehensive and versatile security scanner.

It finds vulnerabilities (CVEs), IaC misconfigurations, exposed secrets,
software licenses and generates SBOMs, across container images, filesystems,
git repositories, virtual machine images and Kubernetes.

For a convenient alias:

sudo snap alias trivy-bp.trivy trivy

To scan images held by a local Docker daemon:

sudo snap connect trivy-bp:docker