Ocimend by CloudTrace Open scanner →
Point · scan · fix · pull

Point at an image. Pull it back fixed.

Ocimend scans your container images for every known vulnerability and FIPS 140-3 gap, then rebuilds them for you: patched (-fixed) or FIPS-enforced (-fips), rescanned, started side by side with the original and published at ocimend.io, ready to docker pull.

nginx python node ubi9-minimal traefik
Free, no sign-upInstant for known imagesPlain-English answersPDF, SARIF, CycloneDX
ocimend scan traefik:v2.10.4
$ ocimend scan traefik:v2.10.4

  VULNERABILITIES            GRADE F
   204 known · 13 critical · 3 actively exploited
   EXPLOITED CVE-2023-44487  golang.org/x/net → 0.17.0
   CRITICAL  CVE-2024-24790  Go stdlib 1.20.6 → 1.21.11
   ⚠ Alpine 3.18 is end-of-life since 2025-05-09
  Fix
   apk upgrade --no-cache libcrypto3 libssl3 busybox
   go get golang.org/x/net@v0.56.0 && go mod tidy

  FIPS 140-3                 NOT READY
   ✘ Go crypto is not FIPS-certified
   ✘ OpenSSL 3.1.3 without its FIPS module
   → rebuild with GOFIPS140=v1.0.0, use a FIPS base image
🛡

Vulnerability scanner

Every known CVE in the OS packages and in Go, Java, Python and Node.js dependencies, with the actively exploited ones first and the exact upgrade that fixes them.

  • Security grade A–F
  • CISA Known Exploited flags
  • Copy-paste fix commands
  • End-of-life OS warnings
Scan for vulnerabilities →
🔐

FIPS 140-3 compliance

Whether every cryptographic module is certified, whether FIPS mode is really on, and what to change to pass, with a live test when you need proof.

  • FIPS-ready verdict and score
  • Certificate for every module
  • Live FIPS mode test
  • Auditor-ready PDF
Check FIPS compliance →
📦

Fixed images, ready to pull

One click rebuilds the image you scanned: the vulnerable OS packages upgraded with its own package manager, or FIPS mode enforced with a validated OpenSSL provider. Nothing is published unless it is better and still starts.

  • Before/after CVE report
  • Smoke-tested against the original
  • FIPS verified live
  • Private images: download or push to your registry
Browse ocimend.io →
—images analysed
—vulnerabilities found
—distinct images
—scans run by users

Recently scanned images

Open any report instantly or download it. See all recent scans → · Image reports →

Loading…
🛡 Vulnerability scanner

Every CVE, the ones that matter first, and the fix.

Hundreds of CVEs become a grade, a short list of upgrades and commands you can paste into your Dockerfile.

Complete

OS and application packages

Debian, Ubuntu, Alpine, Wolfi, Chainguard, Red Hat UBI, Rocky, AlmaLinux and Azure Linux, plus Go, Java, Python and Node.js dependencies.

Prioritised

Exploited first

Vulnerabilities on CISA's Known Exploited list are flagged and sorted to the top, and the grade reflects them.

Actionable

One upgrade per package

The lowest version that fixes everything found, and ready-made apt, apk, dnf, go, npm and pip commands.

Fix the right things first.

The fix plan turns hundreds of CVEs into a handful of upgrades, exploited ones on top, and warns when the base OS itself no longer gets fixes.

Scan for vulnerabilities →
🔐 FIPS 140-3 compliance

FIPS-ready or not, and exactly why.

A clear verdict for your assessor, the certificate behind every cryptographic module, and proof that FIPS mode really works.

—days

FIPS 140-2 certificates moved to the Historical list on 21 September 2026.

Modules validated only under 140-2 are no longer acceptable for new federal acquisitions. Find out which of your images still depend on them.

Check your images
Verdict

FIPS-ready, conditional or not

In plain English, with the reasons and the steps to pass, backed by a detailed checklist.

Certificates

Every module, every certificate

Certified, vendor build, in process or historical, always labelled, including the 140-2 certificates that are now historical.

Proof

Live FIPS test

Is FIPS mode really on, are weak algorithms refused, and which TLS ciphers would the image offer?

Catch regressions between releases.

Compare any two tags: what changed, and whether the new release is still FIPS-ready.

Check FIPS compliance →

What users say

Write a review

Built for pipelines.

Block releases with critical CVEs or broken FIPS posture, send findings to GitHub code scanning, and attach a bill of materials to every release.

SARIF 2.1.0code scanning alerts
CycloneDX 1.6SBOM + vulnerabilities
PDF & Markdownauditors, PRs
JSON + APIautomation
BadgeREADME status
# fail the build on critical CVEs or FIPS findings curl -fsSL https://ocimend.io/install.sh | sh ocimend scan ghcr.io/acme/api:$GITHUB_SHA \ --fail-on-cve critical --fail-on high \ --format sarif -o ocimend.sarif # block regressions between releases ocimend diff ghcr.io/acme/api:1.3 ghcr.io/acme/api:1.4 \ --fail-on-regression

Safe to point at production registries

🔒

Private stays private

Scans made with credentials are never listed publicly, and every report lives behind an unguessable link.

🔑

Credentials never stored

Registry tokens are used for a single scan and then discarded. Use a short-lived, read-only token.

⚡

Nothing to install

Paste an image in the browser, or use the single-file CLI in your terminal and CI.

FAQ

Is Ocimend free?
Yes. The web scanner, the public image reports, the API and the command-line tool are free to use. No sign-up is needed.
Which images can I scan?
Any public image on Docker Hub, GitHub Container Registry, Quay, Amazon ECR Public, Microsoft Container Registry, Google Artifact Registry and other OCI registries. Private registries work too, with a read-only token that is never stored.
Which vulnerabilities does it find?
Known CVEs in operating-system packages (Debian, Ubuntu, Alpine, Wolfi and Chainguard, Red Hat UBI, Rocky Linux, AlmaLinux, Azure Linux) and in application dependencies (Go, Java, Python and Node.js), each with its severity and the version that fixes it. Vulnerabilities that are being actively exploited, from the CISA Known Exploited Vulnerabilities catalog, are flagged and listed first.
Does a FIPS PASS mean my image is certified?
No. It means every cryptographic module in the image is covered by a FIPS 140-3 certificate and FIPS mode is on. Certification also depends on how the software uses cryptography and on your deployment boundary. Use the report as evidence for your assessor.
Why is my Red Hat UBI image only FIPS-ready with conditions?
Red Hat, Amazon Linux, SUSE, Azure Linux and Ubuntu Pro FIPS images switch FIPS mode on when the host they run on is in FIPS mode. The image alone can't guarantee it, so run these workloads on FIPS-enabled nodes.
What does the live test tell me?
Whether the image's cryptography really runs in FIPS mode, whether weak algorithms are refused, and which TLS cipher suites it would offer, measured on the image itself rather than inferred.
Can I use it in CI/CD?
Yes. The CLI fails a build on critical CVEs or FIPS findings, writes SARIF for GitHub code scanning and CycloneDX for your release records, and compares two tags to catch regressions.
How does it fit into CloudTrace?
Ocimend is a CloudTrace product. It lives at ocimend.io (also ocimend.cloudtrace.io) and runs as a CLI and API; the other CloudTrace products are listed at cloudtrace.io.

Run your first container postmortem

Paste an image reference. Every CVE, the fixes and a FIPS verdict in seconds, free.

Open the scanner →