483 matches found
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
EUVD-2026-60957
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...
GO-2024-2958 vulnerabilities
Vulnerabilities for packages: harbor-scanner-trivy-fips, zot, harbor-scanner-trivy...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: trivy, kubescape, snyk-cli, grype, terraform, zarf, zot, k9s, conftest, tflint, wolfictl, tfsec, terragrunt, conftest-fips, trivy-fips, kots...
GO-2026-5983 vulnerabilities
Vulnerabilities for packages: cloudbeat, trivy-operator, cloudbeat-fips, trivy-operator-fips...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: trivy, chartmuseum, kubescape, helm-operator, eksctl, zarf, flux-source-controller, helm-push, k9s, up, zot, flux-helm-controller, k8sgpt, cilium-cli, kots, kubevela...
GO-2025-3888 vulnerabilities
Vulnerabilities for packages: pluto, trivy, chartmuseum, kubescape, flux-source-controller-fips, flux-fips, k8ssandra-client, k8ssandra-client-fips, flux, nova, eksctl, envoy-gateway-fips, zot, envoy-gateway, flux-helm-controller, harbor, trivy-operator, trivy-operator-fips, headlamp,...
GO-2026-5058 vulnerabilities
Vulnerabilities for packages: trivy, kubescape, syft-fips, opentofu, zot, cg, task, tflint, grype-fips, opentofu-fips, trivy-operator, trivy-operator-fips, terragrunt, terragrunt-fips, tfsec, trivy-fips, xeol-fips, tflint-fips, cloudbeat-fips, grype, steampipe, k9s, chainctl-fips,...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: trivy, chartmuseum, kubescape, helm-operator, eksctl, zarf, flux-source-controller, helm-push, k9s, up, zot, flux-helm-controller, k8sgpt, cilium-cli, kots, kubevela...
GO-2026-5435 vulnerabilities
Vulnerabilities for packages: pluto, trivy, chartmuseum, kubescape, flux-source-controller-fips, flux-fips, k8ssandra-client, k8ssandra-client-fips, flux, nova, eksctl, envoy-gateway-fips, gitlab-operator, tigera-operator, zot, envoy-gateway, gitlab-operator-fips, helm-exporter, harbor,...
GO-2025-3601 vulnerabilities
Vulnerabilities for packages: pluto, trivy, chartmuseum, kubescape, flux-source-controller-fips, flux-fips, k8ssandra-client, k8ssandra-client-fips, flux, eksctl, zot, flux-helm-controller, harbor, trivy-fips, helm-operator-fips, harbor-fips, consul-k8s, k9s, flux-helm-controller-fips, kots,...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: trivy, kubescape, podman-fips, livekit-cli, kaniko-fips, zot, scorecard, docker-cli-buildx-fips, guac, trivy-operator-fips, trivy-operator, buildah, trivy-fips, podman, docker-cli-buildx, cloudbeat-fips, kubescape-server-fips, docker-fips, skaffold-fips,...
GO-2024-2491 vulnerabilities
Vulnerabilities for packages: trivy, kubescape, ctop, buildkitd, zot, podman, nerdctl, grype, docker, k9s, kots, k3s, skaffold, zarf, wolfictl, newrelic-infrastructure-agent, skopeo, kaniko, kubernetes, runc, k3d, cadvisor, syft...
GO-2024-2493 vulnerabilities
Vulnerabilities for packages: kaniko, kubescape, trivy, buildkitd, skaffold, docker, zot, conftest, scorecard, guac, conftest-fips...