GO-2026-6162 vulnerabilities

Vulnerabilities for packages: kyverno, flux-source-controller, crossplane, goreleaser, kyverno-notation-aws, zot, policy-controller, skaffold, falcoctl, neuvector-sigstore-interface, aactl, tekton-chains, tkn, kubescape, trivy-operator, spire-server, ko, zarf, trivy...

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328

Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...

EUVD-2026-60957

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

GO-2024-2958 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy-fips, zot, harbor-scanner-trivy...

GO-2024-2948 vulnerabilities

Vulnerabilities for packages: terragrunt, wolfictl, conftest, snyk-cli, tfsec, kubescape, trivy, zot, terraform, tflint, trivy-fips, grype, kots, k9s, conftest-fips, zarf...

GO-2026-5983 vulnerabilities

Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: eksctl, flux-source-controller, helm-operator, up, trivy, flux-helm-controller, kubescape, zot, kubevela, kots, k9s, k8sgpt, zarf, helm-push, cilium-cli, chartmuseum...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: eksctl, flux-source-controller, helm-operator, up, trivy, flux-helm-controller, kubescape, zot, kubevela, kots, k9s, k8sgpt, zarf, helm-push, cilium-cli, chartmuseum...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: helm-set-status, pluto-fips, trivy, zot, cert-manager-cmctl, flux-source-controller-fips, envoy-gateway, pluto, rancher-fleet-fips, cerbos, linkerd2-fips, helm-push, teleport, k9s-fips, nova, chart-testing, cerbos-fips, harbor-fips, flux-helm-controller, headlamp,...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: terragrunt, packer-fips, opentofu, cg, trivy, xeol-fips, zot, xeol, chainctl, crossplane-provider-terraform-fips, kubescape-server-fips, k9s-fips, terragrunt-fips, grype-db, grype, kots, conftest-fips, syft, zarf, task-fips, zarf-fips, trivy-operator, opentofu-fips,...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: helm-set-status, pluto-fips, trivy, zot, cert-manager-cmctl, flux-source-controller-fips, envoy-gateway, tigera-operator, pluto, rancher-fleet-fips, cerbos, gitlab-operator, helm-push, teleport, helm-exporter, k9s-fips, kubescape-server-fips, nova, cerbos-fips,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: trivy, zot, cert-manager-cmctl, flux-source-controller-fips, pluto, helm-push, chart-testing, harbor-fips, flux-helm-controller, harbor, helm-docs, tw, consul-k8s-fips, kots, cluster-api-helm-controller, zarf, flux-helm-controller-fips, helm-operator, kuma, kubescape...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: trivy, buildah-fips, zot, buildah, kaniko-fips, scorecard, kubescape-server-fips, docker-cli-buildx-fips, podman-fips, conftest-fips, docker-fips, trivy-operator, conftest, skaffold-fips, kubescape, docker-cli-buildx, docker-compose, kubescape-server, kaniko, skaffol...

GO-2024-2491 vulnerabilities

Vulnerabilities for packages: trivy, zot, runc, nerdctl, docker, grype, kots, syft, zarf, kubernetes, wolfictl, cadvisor, ctop, k3s, kubescape, buildkitd, newrelic-infrastructure-agent, kaniko, skaffold, k9s, skopeo, k3d, podman...