trivy

Trivy GitLab CI Component A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, a...

trivysupplychainanalysis

Quantitative Analysis of Multi-Stage CI/CD Supply-Chain Attacks A formally verified, quantitative reconstruction of the March-2026 Trivy / "TeamPCP" GitHub Actions supply-chain compromise CVE-2026-33634 — modeled in TLA+, checked exhaustively with TLC, and quantified with the PRISM probabilistic...

OPENSUSE-SU-2026:21801-1 Security update for trivy

This update for trivy fixes the following issues: - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP meth...

OPENSUSE-SU-2026:11713-1 trivy-0.74.0-4.1 on GA media

These are all security issues fixed in the trivy-0.74.0-4.1 package on the GA media of openSUSE Tumbleweed...

trivy-0.74.0-3.1 on GA media (moderate)

trivy-0.74.0-3.1 on GA media Announcement ID: openSUSE-SU-2026:11691-1 Rating: moderate Cross-References: CVE-2026-56855 CVSS scores: CVE-2026-56855 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-56855 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

OPENSUSE-SU-2026:11691-1 trivy-0.74.0-3.1 on GA media

These are all security issues fixed in the trivy-0.74.0-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11676-1 trivy-0.74.0-2.1 on GA media

These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed...

Security update for trivy (moderate)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0312-1 Rating: moderate References: 1276128 Cross-References: CVE-2026-72815 CVE-2026-72816 CVE-2026-72817 CVSS scores: CVE-2026-72815 SUSE: 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21645-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21645-1 advisory. This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing...

GO-2026-6294 Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

GHSA-MCJ4-MPHF-J9FF Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

GO-2026-6250 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy...

OPENSUSE-SU-2026:21645-1 Security update for trivy

This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery bsc1276128. Changes for trivy: - Update to version 0.74.0: release:...

OPENSUSE-SU-2026:11578-1 trivy-0.74.0-1.1 on GA media

These are all security issues fixed in the trivy-0.74.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-80626

These are all security issues fixed in the trivy-0.74.0-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: kyverno, zarf, trivy, zot, falcoctl, neuvector-sigstore-interface, tekton-chains, trivy-operator, kubescape, tkn, flux-source-controller, policy-controller, crossplane, skaffold, goreleaser, aactl, kyverno-notation-aws, ko, spire-server...

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...