GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: trivy-operator...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

EUVD-2026-39479

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser...

GHSA-Q3FV-X8VG-QQM4 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

PT-2026-60978

Name of the Vulnerable Software and Affected Versions trivy versions prior to 0.72.0-2.1 Description A norm.Iter can enter an infinite loop when processing input that contains invalid UTF-8 bytes. UTF-8 is a character encoding capable of encoding all possible Unicode characters. Recommendations...

CVE-2026-49834 vulnerabilities

Vulnerabilities for packages: docker-fips, falcoctl, tekton-chains-fips, image-factory-fips, cloudbeat, crossplane, kyverno-notation-aws-fips, ratify-fips, kubescape-server-fips, kyverno, kubescape-server, tkn-fips, trivy, cloudbeat-fips, teleport-operator-fips, kyverno-notation-aws, tkn, telepor...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: docker-fips, falcoctl, tekton-chains-fips, image-factory-fips, cloudbeat, crossplane, kyverno-notation-aws-fips, ratify-fips, kubescape-server-fips, kyverno, kubescape-server, tkn-fips, trivy, cloudbeat-fips, teleport-operator-fips, kyverno-notation-aws, tkn, telepor...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-glue, kiali, kubevela-fips, mcp-grafana-fips, task, apache-exporter, redpanda-console, aws-flb-firehose-fips, chisel, crossplane-provider-terraform-fips, crossplane-provider-aws-wafregional-fips, grype-fips,...

vuln-chain-3-4-14-demo

vuln-chain-spring-boot — a Trivy "green but owned" demo An in...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21249-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21249-1 advisory. This update for trivy fixes the following issues Update to version 0.72.0. - CVE-2026-54448: tar unpacker reads scanned Helm chart archives .tgz...

Security update for trivy (important)

openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21249-1 Rating: important References: bsc1269269 bsc1269271 Cross-References: CVE-2026-54448 CVE-2026-55092 CVSS scores: CVE-2026-54448 SUSE : 6.5...

OPENSUSE-SU-2026:21249-1 Security update for trivy

This update for trivy fixes the following issues Update to version 0.72.0. - CVE-2026-54448: tar unpacker reads scanned Helm chart archives .tgz with io.ReadAlltr and defines no size limit, which can lead to a DoS bsc1269271. - CVE-2026-55092: org.opencontainers.image.title annotation from OCI...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.72.0-0.1.hum1 aarch64, x8664 trivy-0.72.0-0.1.hum1.src src Security Fixes: trivy: CVE-2026-46680 CVE-2026-47262 CVE-2026-53488...

trivy-0.71.2-2.1 on GA media (moderate)

trivy-0.71.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:11162-1 Rating: moderate Cross-References: CVE-2026-54448 CVE-2026-55092 CVSS scores: CVE-2026-54448 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2026-54448 SUSE : 6.9...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: tkn, kyverno, kubescape, trivy-operator, zarf, policy-controller, goreleaser, gitsign, trivy, spire-server, neuvector-sigstore-interface, ratify, aactl, kyverno-notation-aws, tekton-chains, tflint, crossplane, falcoctl...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: tkn, kyverno, kubescape, trivy-operator, zarf, policy-controller, goreleaser, gitsign, trivy, spire-server, neuvector-sigstore-interface, ratify, aactl, kyverno-notation-aws, tekton-chains, tflint, crossplane, falcoctl...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21072-1 advisory. This update for trivy fixes the following issues Update to version 0.71.2: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input...