CLEANSTART-2026-WA93687 Security fixes in syft 1.39.0-r0

Package syft version 1.39.0-r0 fixes 5 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2026-25934...

CLEANSTART-2026-LO95045 Security fixes in syft 1.39.0-r3

Package syft version 1.39.0-r3 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-BR47007 Security fixes in syft 1.42.4-r0

Package syft version 1.42.4-r0 fixes 11 vulnerabilities: CVE-2026-34165, CVE-2026-33762, CVE-2026-34986, CVE-2026-4660, CVE-2026-39883...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, docker-compose-fips, crossplane-provider-aws-rolesanywhere, pulumi-language-java, crossplane-provider-aws-elbv2, crossplane-provider-aws-emrserverless-fips, terraform-provider-azurerm, crossplane-provider-aws-memorydb-fips, rancher,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, docker-compose-fips, crossplane-provider-aws-rolesanywhere, pulumi-language-java, crossplane-provider-aws-elbv2, crossplane-provider-aws-emrserverless-fips, terraform-provider-azurerm, crossplane-provider-aws-memorydb-fips, rancher,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: argo-cd, grype-fips, backup-restore-operator, zot, pulumi-language-java, omnictl-multiarch, etcd-fips, terraform-fips, buildah-fips, go-discover-fips, gitea, gptscript, trivy-operator, rancher, argo-workflows-fips, frankenphp-8.2, go-discover, gomplate, skaffold,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, guac, kubernetes-dashboard, pulumi-language-java, apko, grype, melange, nfpm, pulumi-language-dotnet, syft, openbao, nuclei, step-issuer, cloud-provider-aws, external-dns, buildah, gomplate, aactl, cilium, scorecard, knative-serving, wolfictl...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: grype-fips, cluster-api-helm-controller-fips, zot, docker-compose-fips, cluster-api-helm-controller, trivy-operator, rancher, helm-operator-fips, skaffold, envoy-gateway, tigera-operator-fips, kubescape, chartmuseum-fips, docker-compose, wolfictl,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: grype-fips, cluster-api-helm-controller-fips, zot, docker-compose-fips, cluster-api-helm-controller, trivy-operator, rancher, helm-operator-fips, skaffold, envoy-gateway, tigera-operator-fips, kubescape, chartmuseum-fips, docker-compose, wolfictl,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: grype-fips, cluster-api-helm-controller-fips, zot, docker-compose-fips, cluster-api-helm-controller, trivy-operator, rancher, helm-operator-fips, skaffold, envoy-gateway, tigera-operator-fips, kubescape, chartmuseum-fips, docker-compose, wolfictl,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: grype-fips, cluster-api-helm-controller-fips, zot, docker-compose-fips, cluster-api-helm-controller, trivy-operator, rancher, helm-operator-fips, skaffold, envoy-gateway, tigera-operator-fips, kubescape, chartmuseum-fips, docker-compose, wolfictl,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: teleport, k3s, eksctl, docker-compose, envoy-gateway, helm, dagger, rancher-agent, kargo, spegel, zot, trivy-operator, grype, helm-mapkubeapis, kubescape-operator, headlamp, xeol, helm-set-status, manifest-tool, neuvector-scanner, syft, chartmuseum, rancher, skaffold...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: teleport, k3s, eksctl, docker-compose, envoy-gateway, helm, dagger, rancher-agent, kargo, spegel, zot, trivy-operator, grype, helm-mapkubeapis, kubescape-operator, headlamp, xeol, helm-set-status, manifest-tool, neuvector-scanner, syft, chartmuseum, rancher, skaffold...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: teleport, k3s, eksctl, docker-compose, envoy-gateway, helm, dagger, rancher-agent, kargo, spegel, zot, trivy-operator, grype, helm-mapkubeapis, kubescape-operator, headlamp, xeol, helm-set-status, manifest-tool, neuvector-scanner, syft, chartmuseum, rancher, skaffold...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: teleport, k3s, eksctl, docker-compose, envoy-gateway, helm, dagger, rancher-agent, kargo, spegel, zot, trivy-operator, grype, helm-mapkubeapis, kubescape-operator, headlamp, xeol, helm-set-status, manifest-tool, neuvector-scanner, syft, chartmuseum, rancher, skaffold...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: teleport, k3s, eksctl, docker-compose, envoy-gateway, helm, dagger, rancher-agent, kargo, spegel, zot, trivy-operator, grype, helm-mapkubeapis, kubescape-operator, headlamp, xeol, helm-set-status, manifest-tool, neuvector-scanner, syft, chartmuseum, rancher, skaffold...