CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitea, wolfictl, boring-registry, goreleaser, grafana-alloy, flux-helm-controller, crossplane-provider-aws-ec2, crossplane-provider-azure-storage, rancher-fleet, trufflehog, gitsign, crossplane-provider-aws-dynamodb, atlantis, kyverno, src-fingerprint, cluster-api,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, q, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api, actions-runner-controller, crossplane-provider-aws-kms, flux-fips, helm-push, openbao-fips, ratify-fips, crossplane-provider-azure-storage, gitness, goreleaser, gitaly, dagger,...

CVE-2026-26189

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

CVE-2026-26189

CVE-2026-26189 affects aquasecurity/trivy-action (GitHub Action) where command injection is possible via unsafely exporting environment variables to trivy_envs.txt and sourcing it in entrypoint.sh. Affected versions are 0.31.0 through 0.33.1; a patch was released in 0.34.0. The issue arises from ...

CVE-2026-26189 Trivy Action has a script injection via sourced env file in composite action

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in aquasecurity/trivy-action versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes...

Trivy Action 操作系统命令注入漏洞

Trivy Action is a container vulnerability scanning tool developed by Aqua Security. Versions of Trivy Action prior to 0.33.1 contain an operating system command injection vulnerability. This vulnerability arises from improper handling of input during the process of exporting environment variables...

Trivy Action has a script injection via sourced env file in composite action

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivyenvs.txt bas...

GHSA-9P44-J4G5-CFX5 Trivy Action has a script injection via sourced env file in composite action

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivyenvs.txt bas...

PT-2026-20567

Name of the Vulnerable Software and Affected Versions aquasecurity/trivy-action versions 0.31.0 through 0.33.1 Description A command injection issue exists in aquasecurity/trivy-action due to insufficient handling of action inputs when exporting environment variables. The action creates export VA...

PT-2026-20564

Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable Export A command injection vulnerability exists in aquasecurity/trivy-action due to improper handling of action inputs when exporting environment variables. The action writes export VAR= lines to trivy envs.txt...

OPENSUSE-SU-2026:20798-1 Security update for trivy

This update for trivy fixes the following issues: Update to version 0.68.2: Security fixes: - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches bsc1227010. - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:20191-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20191-1 advisory. Changes in trivy: - Update to version 0.69.0 bsc1255366, CVE-2025-64702: release: v0.69.0 main 9886 chore: bump trivy-checks to v2 9875 choredep...

OPENSUSE-SU-2026:20191-1 Security update for trivy

This update for trivy fixes the following issues: Changes in trivy: - Update to version 0.69.0 bsc1255366, CVE-2025-64702: release: v0.69.0 main 9886 chore: bump trivy-checks to v2 9875 choredeps: bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 10091 fixrepo: return a nil interfa...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, chezmoi, gitea, grype, pulumi, wolfictl, cerbos, witness, goreleaser, k9s, pulumi-language-dotnet, grafana-alloy, zot, gomplate, osv-scanner, rancher-fleet, timoni, kubevela, gitlab-runner, zarf, kots, scorecard, nuclei, trufflehog, gitsig...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, chezmoi, gitea, grype, pulumi, wolfictl, cerbos, witness, goreleaser, k9s, pulumi-language-dotnet, grafana-alloy, zot, gomplate, osv-scanner, rancher-fleet, timoni, kubevela, gitlab-runner, zarf, kots, scorecard, nuclei, trufflehog, gitsig...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, tekton-pipelines, flux, grype, crossplane-fips, xeol-fips, flux-source-watcher-fips, trivy-operator-fips, argo-workflows-fips, flux-operator, steampipe, kargo, crossplane,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, tekton-pipelines, flux, grype, crossplane-fips, xeol-fips, flux-source-watcher-fips, trivy-operator-fips, argo-workflows-fips, flux-operator, steampipe, kargo, crossplane,...