443 matches found
GO-2026-6162 vulnerabilities
Vulnerabilities for packages: trivy, kyverno-notation-aws, tekton-chains, ko, zot, falcoctl, tkn, kubescape, goreleaser, zarf, policy-controller, skaffold, aactl, neuvector-sigstore-interface, spire-server, crossplane, trivy-operator, kyverno, flux-source-controller...
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...
GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...
EUVD-2026-60957
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
GO-2024-2958 vulnerabilities
Vulnerabilities for packages: harbor-scanner-trivy, zot, harbor-scanner-trivy-fips...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: kubescape, conftest-fips, terraform, trivy-fips, wolfictl, terragrunt, zot, tflint, tfsec, snyk-cli, grype, zarf, conftest, trivy, kots, k9s...
GO-2026-5983 vulnerabilities
Vulnerabilities for packages: cloudbeat-fips, cloudbeat, trivy-operator, trivy-operator-fips...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: kubescape, k8sgpt, zot, helm-operator, eksctl, kots, kubevela, zarf, up, helm-push, trivy, flux-helm-controller, cilium-cli, chartmuseum, flux-source-controller, k9s...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: kubescape, k8sgpt, zot, helm-operator, eksctl, kots, kubevela, zarf, up, helm-push, trivy, flux-helm-controller, cilium-cli, chartmuseum, flux-source-controller, k9s...
GO-2025-3888 vulnerabilities
Vulnerabilities for packages: harbor, chart-testing, kuma, trivy-operator, istio, consul-k8s-fips, helm-set-status, k9s-fips, flux-helm-controller, trivy-operator-fips, cluster-api-helm-controller, k9s, k8ssandra-client, eksctl, chart-testing-fips, flux, cluster-api-helm-controller-fips, helm-pus...
GO-2026-5058 vulnerabilities
Vulnerabilities for packages: terragrunt, syft, packer, trivy-operator, task, terragrunt-fips, k9s-fips, grype-fips, cloudbeat, trivy-operator-fips, task-fips, cg, k9s, xeol-fips, kubescape-server-fips, xeol, tfsec, snyk-cli, grype, syft-fips, opentofu-fips, tflint, kubescape, conftest-fips,...
GO-2026-5435 vulnerabilities
Vulnerabilities for packages: helm-exporter-fips, harbor, chart-testing, kuma, trivy-operator, tw, istio, consul-k8s-fips, tigera-operator, helm-set-status, k9s-fips, kube-arangodb-fips, cloudbeat, trivy-operator-fips, cluster-api-helm-controller, k9s, k8ssandra-client, kubescape-server-fips,...
GO-2025-3601 vulnerabilities
Vulnerabilities for packages: harbor, chart-testing, kuma, tw, consul-k8s-fips, flux-helm-controller, cluster-api-helm-controller, k9s, k8ssandra-client, rancher-helm, eksctl, chart-testing-fips, flux, cluster-api-helm-controller-fips, helm-push, chartmuseum-fips, k8ssandra-client-fips, kubescape...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: docker-cli-buildx, osv-scanner, skaffold-fips, trivy-operator, docker-compose-fips, cloudbeat, trivy-operator-fips, kubescape-server-fips, scorecard, buildah, podman-fips, kaniko-fips, buildah-fips, skaffold, kubescape, conftest-fips, zot, docker-fips, cloudbeat-fips...