bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

ndaal_public_SBOM_Auditor

ndaal SBOM Auditor A single-binary, offline web application to investigate SBOM Software Bill of Materials files. Upload an SBOM or import a folder of them, analyse each with an ensemble of independent tools, review the normalised findings in one local UI, and export the result in eight formats. ...

CLEANSTART-2026-RU37744 Security fix for GHSA-5cv4-jp36-h3mw applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, ip-masq-agent 2.12.0-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt 0.1.8-r2, k8sgpt-operator 0.2.27-r1, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, node-problem-detector 1.35.2-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, thanos-operator 0.3.7-r1, thanos-operator-fips 0.3.7-r1, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, kube-logging-operator 6.4.0-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1

GHSA-5cv4-jp36-h3mw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AQ17255 Security fix for GHSA-qpw4-5x99-6vjp applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-qpw4-5x99-6vjp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UL25414 Security fix for GHSA-9m57-25v3-79x9 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, kumactl 2.13.8-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-9m57-25v3-79x9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XG28222 Security fix for GHSA-q4h4-gmj2-qvw2 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, cert-manager-webhook-pdns-fips 2.5.5-r1, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-q4h4-gmj2-qvw2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CZ69684 Security fix for GHSA-89gr-r52h-f8rx applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, cadvisor-fips 0.60.3-r1, grafana-agent-operator 0.44.3-r1, consul-k8s-fips 1.8.14-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-89gr-r52h-f8rx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EL65452 Security fix for GHSA-rm3j-f69w-wqmq applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, amazon-cloudwatch-agent 1.300065.0-r1, trillian-fips 1.7.3-r1, melange 0.55.0-r1, litestream 0.5.14-r1, crossplane-provider-sql-fips 0.15.0-r2, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, node-problem-detector 1.35.2-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, argo-events 1.6.3-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, vault-k8s-fips 1.7.5-r1, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-rm3j-f69w-wqmq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FO29695 Security fix for GHSA-x527-x647-q7gg applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, melange 0.55.0-r1, litestream 0.5.14-r1, crossplane-provider-sql-fips 0.15.0-r2, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, node-problem-detector 1.35.2-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, distribution-fips 3.1.1-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2

GHSA-x527-x647-q7gg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WN23323 Security fix for GHSA-xhf5-7wjv-pqxp applied in: syft 1.43.0-r1, tigera-operator-fips 1.40.13-r1, kaniko 1.24.0-r2

GHSA-xhf5-7wjv-pqxp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VD26945 Security fix for GHSA-jpcc-p29g-p8mq applied in: syft 1.43.0-r1, tigera-operator-fips 1.40.13-r1, kaniko 1.24.0-r2

GHSA-jpcc-p29g-p8mq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EZ61914 Security fix for GHSA-rgh6-rfwx-v388 applied in: syft 1.43.0-r1, kaniko 1.24.0-r2

GHSA-rgh6-rfwx-v388 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QP74390 Security fix for GHSA-cvxm-645q-p574 applied in: syft 1.43.0-r1, kaniko 1.24.0-r2

GHSA-cvxm-645q-p574 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IG56991 Security fix for GHSA-33vj-92qq-66hc applied in: syft 1.43.0-r1, kaniko 1.24.0-r2

GHSA-33vj-92qq-66hc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.55.0-0.3.hum1 aarch64, s390x, x8664 syft-1.55.0-0.3.hum1.src src Security Fixes: syft: CVE-2026-116591...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.55.0-0.2.hum1 aarch64, s390x, x8664 syft-1.55.0-0.2.hum1.src src Security Fixes: syft: CVE-2026-111943...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.54.1-0.2.hum1 aarch64, s390x, x8664 syft-1.54.1-0.2.hum1.src src...

syft

Syft Uno strumento CLI e una libreria Go per generare una Software Bill of Materials SBOM da immagini container e filesystem. Eccezionale per il rilevamento di vulnerabilità se utilizzato con uno scanner comeGrype. Funzionalità Genera SBOM per immagini container , filesystem , archivi consultare ...

CLEANSTART-2026-RO28104 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the syft package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

CLEANSTART-2026-BH69902 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the syft package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...