[jsulinski]

That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD.

There are certainly flaws in this approach; it's one of the reasons we intend to support multiple scanners. We started with vuls because clair wasn't released yet and we wanted to support more than containers.

[wyldfire]

Are there any dynamic scanners that are designed like Vuls or Clair (I'm assuming they're both static)?

[jsulinski]

I don't fully understand the question.

clair does static analysis

vuls uses a package manager and changelogs

[wyldfire]

Are there (any) dynamic analysis options available that would give a report similar in scope to clair or vuls?