GO-2025-3367 vulnerabilities

Vulnerabilities for packages: snyk-cli, trivy, src-fingerprint, chezmoi, syft, dagger, gptscript, gitea, bom, pulumi-language-java, zot, kaniko, osv-scanner, gitsign, nuclei, scorecard, flux-kustomize-controller, timoni, kubevela, zarf, k9s, pulumi-language-yaml, kargo, kubescape, tfsec,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: snyk-cli, kyverno, trivy, src-fingerprint, chezmoi, syft, steampipe, xeol, dagger, gitaly, gptscript, gitea, bom, pulumi-language-java, zot, kaniko, osv-scanner, gitsign, nuclei, scorecard, kubevela, external-secrets-operator, zarf, k9s, pulumi-language-yaml, kargo,...

GO-2026-5490 vulnerabilities

Vulnerabilities for packages: scorecard, telegraf, external-secrets-operator, rclone, syft, rancher-fleet, teleport, gitaly, argo-cd, cerbos, terragrunt, flux...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: scorecard, telegraf, external-secrets-operator, rclone, syft, rancher-fleet, teleport, gitaly, argo-cd, cerbos, terragrunt...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: buf, cilium-cli, trivy, aactl, syft, spire-server, dagger, zot, kaniko, conftest, ko, kargo, kubescape, melange, up, cadvisor, grype, ctop, buildkitd, wolfictl, crossplane, tkn, docker-compose...

GO-2026-5105 vulnerabilities

Vulnerabilities for packages: snyk-cli, kyverno, trivy, src-fingerprint, syft, steampipe, xeol, dagger, gitaly, gptscript, gitea, bom, pulumi-language-java, zot, terragrunt, kaniko, osv-scanner, gitsign, nuclei, scorecard, kubevela, external-secrets-operator, zarf, k9s, pulumi-language-yaml, karg...

GO-2026-5006 vulnerabilities

Vulnerabilities for packages: trivy, syft, spire-server, k3s, zot, terragrunt, opentofu, scorecard, gitlab-kas, k9s, prometheus-operator, step, trivy-operator, pulumi-kubernetes-operator, witness, fscrypt, gomplate, opentelemetry-collector, pulumi, openbao, snyk-cli, chezmoi, dagger,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, trivy, crossplane-provider-aws-elasticache, syft, crossplane-provider-aws-cloudfront, crossplane-provider-azure-storage, spire-server, k3s, zot, terragrunt, opentofu, scorecard, gitlab-kas, k9s, terraform-provider-azurerm, kargo,...

CLEANSTART-2026-WA93687 Security fixes in syft 1.39.0-r0

Package syft version 1.39.0-r0 fixes 5 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2026-25934...

CLEANSTART-2026-LO95045 Security fixes in syft 1.39.0-r3

Package syft version 1.39.0-r3 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-BR47007 Security fixes in syft 1.42.4-r0

Package syft version 1.42.4-r0 fixes 11 vulnerabilities: CVE-2026-34165, CVE-2026-33762, CVE-2026-34986, CVE-2026-4660, CVE-2026-39883...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, crossplane-provider-aws-macie2, atlantis, docker-fips, crossplane-provider-aws-efs-fips, gitlab-runner, gitlab-cng, slsa-verifier, kube-arangodb-fips, crossplane-aws-provider, crossplane-provider-aws-rds, crossplane-provider-aws-guardduty,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, crossplane-provider-aws-macie2, atlantis, docker-fips, crossplane-provider-aws-efs-fips, gitlab-runner, gitlab-cng, slsa-verifier, kube-arangodb-fips, crossplane-aws-provider, crossplane-provider-aws-rds, crossplane-provider-aws-guardduty,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: chezmoi, gomplate-fips, knative-serving-fips, trufflehog-fips, external-secrets-operator, step, skaffold, chainctl-fips, rancher-agent, etcd, flux-image-automation-controller, prometheus-operator, tigera-operator, kyverno, terragrunt-fips, skaffold-fips,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: trivy, syft, spire-server, k3s, zot, terragrunt, opentofu, scorecard, gitlab-kas, k9s, prometheus-operator, step, trivy-operator, pulumi-kubernetes-operator, witness, fscrypt, gomplate, opentelemetry-collector, pulumi, openbao, snyk-cli, chezmoi, dagger,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: kaniko-fips, tigera-operator-fips, helm-operator-fips, helmfile, buildkitd, docker-fips, skaffold, chainctl-fips, rancher-agent, tigera-operator, spegel-fips, newrelic-infrastructure-agent, newrelic-infrastructure-agent-fips, kgateway, skaffold-fips, chartmuseum,...