syft 安全漏洞

Syft is an open-source CLI tool and Go library developed by Anchore, used to generate Software Bill of Materials SBOMs from container images and file systems. Versions of Syft prior to 1.42.3 contain security vulnerabilities. These vulnerabilities stem from improper cleanup of temporary storage...

GO-2026-4809 Syft improper temporary file cleanup in github.com/anchore/syft

Syft improper temporary file cleanup in github.com/anchore/syft...

CVE-2026-33481 vulnerabilities

Vulnerabilities for packages: k9s-fips, zarf-fips, zarf, kubescape-server-fips, xeol-fips, k9s, xeol, syft-fips, kubescape-server, kubescape-operator-fips, chainctl-fips, wolfictl, grype-db, chainctl, guac, kubescape, kubescape-operator, cg...

GHSA-RJCW-VG7J-M9RC vulnerabilities

Vulnerabilities for packages: k9s-fips, zarf-fips, zarf, kubescape-server-fips, xeol-fips, k9s, xeol, syft-fips, kubescape-server, kubescape-operator-fips, chainctl-fips, wolfictl, grype-db, chainctl, guac, kubescape, kubescape-operator, cg...

Improper Cleanup on Thrown Exception

Overview Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception when cleaning up tmp files. Temporary storage can be exhausted during the scanning process by an attacker providing large or highly compressed artifacts, leading to the accumulation of temporary file...

Improper Cleanup on Thrown Exception

Overview Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception when cleaning up tmp files. Temporary storage can be exhausted during the scanning process by an attacker providing large or highly compressed artifacts, leading to the accumulation of temporary file...

GHSA-RJCW-VG7J-M9RC Syft improper temporary file cleanup

Impact Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the...

Syft improper temporary file cleanup

Impact Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: redpanda, yunikorn-k8shim, cluster-autoscaler, thanos, pulumi-language-dotnet, cadvisor, kubernetes-dashboard, aws-load-balancer-controller, azuredisk-csi, gitness, terraform-provider-google, kubernetes-csi-external-health-monitor, tfsec,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: redpanda, yunikorn-k8shim, cluster-autoscaler, thanos, pulumi-language-dotnet, cadvisor, kubernetes-dashboard, aws-load-balancer-controller, azuredisk-csi, gitness, terraform-provider-google, kubernetes-csi-external-health-monitor, tfsec,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: redpanda, cluster-autoscaler, logstash-exporter, terraform-provider-google, kaniko, kubernetes-csi-external-health-monitor, vault-env, rootlesskit, sbom-scorecard, cluster-api, whereabouts, kubeflow, mattermost, portieris, cortex, cass-operator, node-problem-detector...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: redpanda, cluster-autoscaler, logstash-exporter, terraform-provider-google, kaniko, kubernetes-csi-external-health-monitor, vault-env, rootlesskit, sbom-scorecard, cluster-api, whereabouts, kubeflow, mattermost, portieris, cortex, cass-operator, node-problem-detector...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: redpanda, cluster-autoscaler, logstash-exporter, terraform-provider-google, kaniko, kubernetes-csi-external-health-monitor, vault-env, rootlesskit, sbom-scorecard, cluster-api, whereabouts, kubeflow, mattermost, portieris, cortex, cass-operator, node-problem-detector...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: redpanda, cluster-autoscaler, logstash-exporter, terraform-provider-google, kaniko, kubernetes-csi-external-health-monitor, vault-env, rootlesskit, sbom-scorecard, cluster-api, whereabouts, kubeflow, mattermost, portieris, cortex, cass-operator, node-problem-detector...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: aws-nuke, php-fpmexporter, kubescape-server-fips, mig-parted-fips, calico-fips, go-spdk-helper, helm-docs, yunikorn-k8shim-fips, consul-k8s, kube-mgmt, longhorn-backing-image-manager, metrics-agent-fips, neuvector-sigstore-interface, openbao-k8s-fips,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, yunikorn-k8shim-fips, longhorn-backing-image-manager, sftpgo-plugin-eventstore, neuvector-sigstore-interface, sqlexporter-fips, kyverno-fips, kubescape, beats-fips, kubernetes-csi-driver-hostpath, kubernetes-csi-node-driver-registrar, cri-tools...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, grype-fips, velero-fips, calico-fips, kyverno-fips, kubescape, beats-fips, cri-tools, opencost-fips, kaniko, docker-compose-fips, cluster-api-fips, datadog-operator, kubevela-fips, knative-net-istio-fips, temporal, argocd-image-updater-fips,...

OPENSUSE-SU-2026:10228-1 syft-1.42.1-1.1 on GA media

These are all security issues fixed in the syft-1.42.1-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2023-0732

Malicious code in bioql PyPI...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: xeol, tfsec, syft, k9s, steampipe, grype, opentofu, rancher-fleet, terraform, kots, terragrunt, kubescape, zot, trivy, snyk-cli, trivy-operator, conftest, zarf, tflint, wolfictl...