casareanderson/sieve is a tool that reads package lists from existing files on Linux boxes and on the containers running on top of them, queries OSV.dev, and sorts the results based on the list of vulnerabilities known to have been used in actual attacks (CISA KEV) and exploit prediction scores (EPSS). There is no scanner binary, no vulnerability database, and no server. The commit on 2026-11-02 (118978e, 'bench: weekly results 2026-11-02') regenerated only the two benchmark result files in this repository (bench/RESULTS.md, bench/results.json), with no code changes. 162 lines added, 122 lines deleted.
The results were collected in a GitHub Actions ubuntu24 environment with 4 CPUs, using 8 images pinned by digest. Summing the deduplicated CVE counts per image gives sieve 741, trivy 943, grype 1303, and osv-scanner 858, but the file itself states that "more is not automatically better," because the tools count different things. There were 5 (image, CVE) pairs known to be used in actual attacks that at least one tool found: sieve caught 3, trivy 3, grype 5, and osv-scanner 3. Total scan time and peak memory were sieve 0.6.0 at 15 seconds / 107 MB, trivy 0.74.0 at 2.0 seconds / 317 MB (DB download 5.1 seconds), grype 0.119.0 at 23 seconds / 354 MB (DB update 85 seconds), and osv-scanner 2.6.0 at 22 seconds / 917 MB. There were 0 cases in which sieve alone reported a CVE that the other tools did not find.
There are also clear parts that cloud the judgment. These figures come from running the repository's own benchmark, not from an independent test. sieve missed 702 (image, CVE) pairs that at least one other tool reported; of those, 2 were KEV and 53 were rated CRITICAL by the other tools' criteria. The CVEs newly added to the "missed by sieve" list in this update — CVE-2026-111497 (node, CRITICAL, KEV) and CVE-2026-115557 (python, CRITICAL) — are described in the file as being of a type that sieve does not read, because the files are in binary package form. The KEV catalog used as the comparison baseline also changed from 2026.10.23 (1,756 entries) to 2026.10.30 (1,766 entries), and it moves every week. So sieve is closer to a prioritization layer that decides what to look at first from the list of already-installed packages, and it is hard to view it as a replacement for the full vulnerability list.