CLEANSTART-2026-NA71469 Security fixes in syft 1.43.0-r1

Package syft version 1.43.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

PT-2026-85966

Package syft version 1.43.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CLEANSTART-2026-BR47007 Security fixes in syft 1.42.4-r0

Package syft version 1.42.4-r0 fixes 11 vulnerabilities: CVE-2026-34165, CVE-2026-33762, CVE-2026-34986, CVE-2026-4660, CVE-2026-39883...

CLEANSTART-2026-LO95045 Security fixes in syft 1.39.0-r3

Package syft version 1.39.0-r3 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-WA93687 Security fixes in syft 1.39.0-r0

Package syft version 1.39.0-r0 fixes 5 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2026-25934...

Malicious Package

Overview syft-acp-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63706

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, etcd, crossplane-provider-aws-datasync-fips, flux-kustomize-controller-fips, kyverno-fips, rancher, crossplane-provider-azure-resources, splunk-otel-collector, kubernetes-fips, crossplane-provider-aws-kafkaconnect, juicefs,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: upwind-agent, gitlab-kas, etcd, docker-machine-driver-harvester, commercial-grafana, kyverno-fips, rancher, kubescape, gitlab-workhorse-ce-fips, kubernetes-fips, vault-fips, apko, prometheus-mongodb-exporter, prometheus-podman-exporter-fips, mattermost-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, etcd, crossplane-provider-aws-datasync-fips, flux-kustomize-controller-fips, kyverno-fips, rancher, crossplane-provider-azure-resources, splunk-otel-collector, kubernetes-fips, crossplane-provider-aws-kafkaconnect, juicefs,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: osv-scanner, prometheus-operator, falco-no-driver, grype, step-issuer, aactl, flux, external-dns, kots, buildah, kyverno, mattermost, guac, kaf, act, nuclei, opentofu, apko, syft, kubernetes, gitea, helm, trivy, skaffold, external-secrets-operator, loki, kine,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, helm-mapkubeapis, helm-fips, xeol-fips, rancher, kubescape, xeol, helm-exporter-fips, kgateway-fips, syft, wolfictl, datadog-agent, grype-fips, redpanda-operator, teleport, docker-fips, chartmuseum-fips, ctop, crossplane-fips,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, helm-mapkubeapis, helm-fips, xeol-fips, rancher, kubescape, xeol, helm-exporter-fips, kgateway-fips, syft, wolfictl, datadog-agent, grype-fips, redpanda-operator, teleport, docker-fips, chartmuseum-fips, ctop, crossplane-fips,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, helm-mapkubeapis, helm-fips, xeol-fips, rancher, kubescape, xeol, helm-exporter-fips, kgateway-fips, syft, wolfictl, datadog-agent, grype-fips, redpanda-operator, teleport, docker-fips, chartmuseum-fips, ctop, crossplane-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, helm-mapkubeapis, helm-fips, xeol-fips, rancher, kubescape, xeol, helm-exporter-fips, kgateway-fips, syft, wolfictl, datadog-agent, grype-fips, redpanda-operator, teleport, docker-fips, chartmuseum-fips, ctop, crossplane-fips,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: spegel, kaniko, neuvector-scanner, cluster-api-helm-controller, helm, helm-mapkubeapis, manifest-tool, falco-no-driver, kubescape-operator, rancher-helm, skaffold, teleport, envoy-gateway, docker-cli-buildx, trivy, steampipe, grype, kube-arangodb, kubevela, scorecard...