443 matches found
GO-2026-6162 vulnerabilities
Vulnerabilities for packages: falcoctl, trivy, zarf, spire-server, flux-source-controller, neuvector-sigstore-interface, policy-controller, aactl, tkn, kubescape, crossplane, goreleaser, zot, kyverno-notation-aws, trivy-operator, kyverno, tekton-chains, skaffold, ko...
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...
GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
EUVD-2026-60957
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328
Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...
GO-2024-2958 vulnerabilities
Vulnerabilities for packages: harbor-scanner-trivy-fips, zot, harbor-scanner-trivy...
GO-2026-5983 vulnerabilities
Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: k9s, zarf, conftest-fips, snyk-cli, trivy-fips, zot, kubescape, tflint, conftest, trivy, grype, terragrunt, tfsec, wolfictl, terraform, kots...
GO-2024-2554 vulnerabilities
Vulnerabilities for packages: k9s, chartmuseum, cilium-cli, flux-helm-controller, zarf, k8sgpt, kubevela, zot, up, eksctl, kubescape, trivy, helm-operator, flux-source-controller, helm-push, kots...
GO-2026-5058 vulnerabilities
Vulnerabilities for packages: crossplane-provider-terraform, k9s-fips, kubescape-server-fips, snyk-cli, cloudbeat, trivy-fips, xeol, packer-fips, tfsec, terragrunt-fips, task-fips, tflint-fips, opentofu, chainctl-fips, zarf-fips, cloudbeat-fips, conftest, grype, terragrunt, chainctl,...
GO-2025-3888 vulnerabilities
Vulnerabilities for packages: rancher-fleet, chart-testing, k9s-fips, k8sgpt, linkerd2-fips, trivy-fips, cluster-api-helm-controller-fips, consul-k8s, chart-testing-fips, headlamp-fips, flux, istio, headlamp, helm-set-status, k8ssandra-client, cerbos-fips, cilium-cli, k8ssandra-client-fips, eksct...
GO-2024-2575 vulnerabilities
Vulnerabilities for packages: k9s, chartmuseum, cilium-cli, flux-helm-controller, zarf, k8sgpt, kubevela, zot, up, eksctl, kubescape, trivy, helm-operator, flux-source-controller, helm-push, kots...
GO-2026-5435 vulnerabilities
Vulnerabilities for packages: rancher-fleet, chart-testing, k9s-fips, kubescape-server-fips, linkerd2-fips, cloudbeat, trivy-fips, chaos-mesh, cluster-api-helm-controller-fips, zot, consul-k8s, chart-testing-fips, headlamp-fips, flux, istio, headlamp, helm-set-status, k8ssandra-client, cerbos-fip...
GO-2025-3601 vulnerabilities
Vulnerabilities for packages: chart-testing, trivy-fips, cluster-api-helm-controller-fips, consul-k8s, chart-testing-fips, flux, k8ssandra-client, cilium-cli, k8ssandra-client-fips, eksctl, tw, helm-docs, rancher-helm, helm-push, chartmuseum, flux-helm-controller, zarf, pluto, harbor,...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: osv-scanner, podman, kubescape-server-fips, docker-cli-buildx, docker-compose-fips, livekit-cli, cloudbeat, trivy-fips, guac, cloudbeat-fips, kaniko, conftest, scorecard, docker-fips, kubescape-server, podman-fips, docker-compose, skaffold-fips, kubescape,...