CVE-2026-26189

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189

CVE-2026-26189 affects aquasecurity/trivy-action (GitHub Action) where command injection is possible via unsafely exporting environment variables to trivy_envs.txt and sourcing it in entrypoint.sh. Affected versions are 0.31.0 through 0.33.1; a patch was released in 0.34.0. The issue arises from ...

Trivy Action 操作系统命令注入漏洞

Trivy Action is a container vulnerability scanning tool developed by Aqua Security. Versions of Trivy Action prior to 0.33.1 contain an operating system command injection vulnerability. This vulnerability arises from improper handling of input during the process of exporting environment variables...

GHSA-9P44-J4G5-CFX5 Trivy Action has a script injection via sourced env file in composite action

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivyenvs.txt bas...

Trivy Action has a script injection via sourced env file in composite action

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivyenvs.txt bas...

PT-2026-20564

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivy envs.txt...

PT-2026-20567

Name of the Vulnerable Software and Affected Versions aquasecurity/trivy-action versions 0.31.0 through 0.33.1 Description A command injection issue exists in aquasecurity/trivy-action due to insufficient handling of action inputs when exporting environment variables. The action creates export VA...

OPENSUSE-SU-2026:20798-1 Security update for trivy

This update for trivy fixes the following issues: Update to version 0.68.2: Security fixes: - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches bsc1227010. - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20191-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20191-1 advisory. Changes in trivy: - Update to version 0.69.0 bsc1255366, CVE-2025-64702: release: v0.69.0 main 9886 chore: bump trivy-checks to v2 9875 choredep...

OPENSUSE-SU-2026:20191-1 Security update for trivy

This update for trivy fixes the following issues: Changes in trivy: - Update to version 0.69.0 bsc1255366, CVE-2025-64702: release: v0.69.0 main 9886 chore: bump trivy-checks to v2 9875 choredeps: bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 10091 fixrepo: return a nil interfa...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: scorecard, flux-kustomize-controller, osv-scanner, rancher-fleet, kots, gptscript, grafana-alloy, melange, kubevela, kyverno, crossplane, timoni, gitlab-runner, witness, skaffold, zot, guac, snyk-cli, src-fingerprint, tfsec, cerbos, gitea, kargo, trivy-operator,...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: scorecard, flux-kustomize-controller, osv-scanner, rancher-fleet, kots, gptscript, grafana-alloy, melange, kubevela, kyverno, crossplane, timoni, gitlab-runner, witness, skaffold, zot, guac, snyk-cli, src-fingerprint, tfsec, cerbos, gitea, kargo, trivy-operator,...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: chezmoi, gomplate-fips, grafana, trufflehog, crossplane, kubevela-fips, flux-source-controller-fips, gitaly, pulumi, trivy-fips, google-osconfig-agent, snyk-cli, livekit-cli, amazon-ssm-agent-fips, trivy-operator, kots, crossplane-fips, src-fingerprint-fips,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: chezmoi, gomplate-fips, grafana, trufflehog, crossplane, kubevela-fips, flux-source-controller-fips, gitaly, pulumi, trivy-fips, google-osconfig-agent, snyk-cli, livekit-cli, amazon-ssm-agent-fips, trivy-operator, kots, crossplane-fips, src-fingerprint-fips,...

trivy-0.69.0-1.1 on GA media (moderate)

trivy-0.69.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10131-1 Rating: moderate Cross-References: CVE-2025-64702 CVE-2025-66564 CVSS scores: CVE-2025-64702 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-64702 SUSE : 6.9...

OPENSUSE-SU-2026:10131-1 trivy-0.69.0-1.1 on GA media

These are all security issues fixed in the trivy-0.69.0-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE 16 : Recommended update for trivy (SUSE-SU-openSUSE-RU-2026:20010-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-openSUSE-RU-2026:20010-1 advisory. - Update to version 0.68.2: release: v0.68.2 release/v0.68 9950 fixdeps: bump alpine from 3.22.1 to 3.23.0 backport: release/v0.68 9949...