Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Publisher’s description
What is Trivy?
Trivy by Aqua Security Software is open-source Windows software in the containers & devops category. It ranks 19th by popularity among containers & devops in this catalogue. It is written in Go.
Installation and requirements
The publisher provides Portable installers for 64-bit Windows. It runs without installation (portable).
Updates and version history
The current version is 0.76.1, released on October 21, 2026. The version history goes back to March 1, 2026: 12 releases, all linked to the official files. The last update is less than a month old.
Popularity and file types
The Chocolatey package has been downloaded 82,749 times. The source code on GitHub (aquasecurity/trivy) has 38,607 stars. On Windows it registers 1 file type, including .trivyignore. Similar programs include Pulumi, Docker Compose and Kubernetes - Minikube - A Local Kubernetes Development Environment.
Project description on GitHub: “Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Portable: runs without installation
- Updated in the last two months
- Large user base
Cons
- No native ARM64 build
In short: Trivy is an open-source containers & devop tool for 64-bit PCs.
Is Trivy safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
1051F49CB22D5284F43425F72AAD9CDA63CA12CEB92E7CAA06903490C82DC9BF· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Security practices (OpenSSF Scorecard)
Automated checks of the aquasecurity/trivy repository on GitHub by the Open Source Security Foundation, last run on March 16, 2026.
- No dangerous workflows10
- Code review10
- Security policy10
- Actively maintained10
- No binaries in the repository10
- Licence declared10
- Published packages10
- Pinned dependencies7
- Branch protection4
- Signed releases3
- Static code analysis1
- OpenSSF Best Practices badge0
- Restricted token permissions0
- Fuzzing0
The score rates how the project is developed and released, not whether the program is safe to install. scorecard.dev
Recent versions
All 12 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 0.76.1Latest | October 21, 2026 | — | 64-bit ZIP |
| 0.76.0 | October 14, 2026 | — | 64-bit ZIP |
| 0.75.0 | October 1, 2026 | — | 64-bit ZIP |
| 0.74.0 | August 14, 2026 | — | 64-bit ZIP |
| 0.73.0 | June 30, 2026 | — | 64-bit ZIP |
| 0.72.0 | June 30, 2026 | — | 64-bit ZIP |
| 0.71.2 | June 19, 2026 | — | 64-bit ZIP |
| 0.71.1 | June 15, 2026 | — | 64-bit ZIP |
Install from the command line
Silent install ›winget install --id AquaSecurity.Trivy -echoco install trivy -yProgram files (.exe): trivy.exe
Related guide: How to use winget: install and update apps
Information
- Publisher
- Aqua Security Software
- Category
- Containers & DevOps
- Licence
- Apache-2.0
- Price
- Free
- Source code
- github.com/aquasecurity/trivy
- Written in
- Go
- Requires
- Windows 11 / 10
- Architecture
- 64-bit
- Installer
- Portable
- Version
- 0.76.1
- Released
- October 21, 2026
- Added to the catalogue
- March 1, 2026
- Versions listed
- 12
- Chocolatey downloads
- 82,749
- GitHub stars
- 38,607
- GitHub forks
- 789
- Website
- aquasecurity.github.io
- winget ID
- AquaSecurity.Trivy
- Chocolatey package
- trivy
File types it opens (1)
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to Trivy
See all ›-
Open source395.6K ↓ -
Open source559.4K ↓ -
Kubernetes - Minikube - A Local Kubernetes Development Environment1.39.0minikube quickly sets up a local Kubernetes cluster on macOS, Linux, and Windows. We proudly focus on helping application developers and new Kubernetes users.Open source747.8K ↓ -
Open source1.6M ↓ -
Open source156.5K ↓ -
Open source299.3K ↓ -
Serverless Framework3.39.0Build applications on AWS Lambda and other next-gen cloud services, that auto-scale and only charge you when they run.Open source84.9K ↓ -
Open source2.3M ↓
Frequently asked questions
Is Trivy free?
Yes. Trivy is open-source software under the Apache-2.0 licence.
Is Trivy safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install Trivy with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does Trivy run on ARM (Windows on Arm)?
There is no ARM64 build; Windows 11 on Arm can run the 64-bit version through emulation.
Where can I download an older version of Trivy?
The versions page lists all 12 versions with links to their official installer files, back to March 1, 2026.
Can I use Trivy without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to Trivy?
Pulumi, Docker Compose, Kubernetes - Minikube - A Local Kubernetes Development Environment, Helm and Grype. The alternatives page compares them.
