479 matches found
GO-2026-4349 vulnerabilities
Vulnerabilities for packages: goreleaser, kyverno-notation-aws, falcoctl, tekton-chains, kubescape, buildkitd, slsa-verifier, vexctl, cosign, crossplane, spire-server, ratify, aactl, skaffold, tkn, policy-controller, witness, trivy, gitsign, teleport, zot, ko, kyverno, tflint, rekor,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: oauth2-proxy, nri-f5, envconsul, cluster-api-provider-vsphere, dive, thanos-operator, tempo, libnvidia-container, yunikorn-k8shim, nri-mysql, nats-server-config-reloader, steampipe, cloud-sql-proxy, tkn, witness, nri-consul, conftest, nri-apache,...
GO-2026-4348 vulnerabilities
Vulnerabilities for packages: goreleaser, kyverno-notation-aws, falcoctl, tekton-chains, kubescape, buildkitd, slsa-verifier, vexctl, cosign, crossplane, spire-server, ratify, aactl, skaffold, tkn, policy-controller, witness, trivy, gitsign, teleport, zot, ko, kyverno, tflint, rekor,...
GO-2024-3166 vulnerabilities
Vulnerabilities for packages: apko, falcoctl, tekton-chains, kubescape, slsa-verifier, vexctl, cosign, spire-server, aactl, tkn, policy-controller, wolfictl, trivy, gitsign, zot, melange, rekor, flux-source-controller, zarf, neuvector-sigstore-interface, sigstore-scaffolding, gh...
GO-2024-3250 vulnerabilities
Vulnerabilities for packages: actions-runner-controller, crossplane-provider-family-azure, goreleaser, openbao, weaviate, crossplane-provider-azure-storage, octo-sts, bank-vaults, opentelemetry-collector-contrib, falcoctl, k3s, pulumi-kubernetes-operator, tekton-chains, kubescape, buildkitd, mc,...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.73.0-0.1.hum1 aarch64, x8664 trivy-0.73.0-0.1.hum1.src src...
CLEANSTART-2026-SJ20797 Security fixes in trivy-fips 0.67.2-r0
Package trivy-fips version 0.67.2-r0 fixes 5 vulnerabilities: ghsa-cgrx-mc8f-2prm, ghsa-pwhc-rpq9-4c8w, ghsa-m6hq-p25p-ffr2, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
CLEANSTART-2026-RR89078 Security fixes in harbor-scanner-trivy 0.35.1-r0
Package harbor-scanner-trivy version 0.35.1-r0 fixes 3 vulnerabilities: CVE-2025-54410, CVE-2025-15558, CVE-2025-29923...
CLEANSTART-2026-QI00029 Security fixes in harbor-scanner-trivy-fips 0.35.1-r0
Package harbor-scanner-trivy-fips version 0.35.1-r0 fixes 3 vulnerabilities: CVE-2025-54410, CVE-2025-15558, CVE-2025-29923...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.72.0-0.1.3.hum1 aarch64, x8664 trivy-0.72.0-0.1.3.hum1.src src Security Fixes: trivy: CVE-2026-49834...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.72.0-0.1.2.hum1 aarch64, x8664 trivy-0.72.0-0.1.2.hum1.src src Security Fixes: trivy: CVE-2026-15788 CVE-2026-15792 CVE-2026-56852...
GO-2026-5983 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...
Security update for trivy (important)
openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...
openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21395-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21395-1 advisory. This update for trivy fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...
Security update for trivy (important)
openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21395-1 Rating: important References: bsc1266495 bsc1271658 bsc1271670 Cross-References: CVE-2026-39821 CVE-2026-50151 CVE-2026-56852 CVSS scores:...
CLEANSTART-2026-LZ81863 Security fixes for CVE-2025-29923, CVE-2026-34040, CVE-2026-39822, CVE-2026-49834, CVE-2026-49835, CVE-2026-50151 applied in versions: 0.36.0-r0, 0.36.0-r1
Multiple security vulnerabilities affect the harbor-trivy-adapter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...
PT-2026-60918
Name of the Vulnerable Software and Affected Versions Trivy versions prior to 0.72.0 Description A path traversal flaw exists in the plugin manager where plugin manifest metadata is used to construct paths under /.trivy/plugins without properly confining plugin names to that root. An attacker can...
OPENSUSE-SU-2026:11302-1 trivy-0.72.0-2.1 on GA media
These are all security issues fixed in the trivy-0.72.0-2.1 package on the GA media of openSUSE Tumbleweed...
Uncontrolled Resource Consumption
github.com/aquasecurity/trivy is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the custom tar unpacker reading Helm chart archive .tgz entries using io.ReadAll without enforcing a size limit, which allows an attacker to supply a malicious compressed archive that...