OPENSUSE-SU-2026:11162-1 trivy-0.71.2-2.1 on GA media

These are all security issues fixed in the trivy-0.71.2-2.1 package on the GA media of openSUSE Tumbleweed...

Security update for trivy (important)

openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21072-1 Rating: important References: bsc1267268 bsc1268356 bsc1268399 bsc1268400 bsc1268403 bsc1268404 bsc1268440 Cross-References: CVE-2026-44740...

SUSE CVE-2026-54448

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...

SUSE CVE-2026-55092

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-fips, etcd, kyverno-fips, kots, upwind-agent, argo-workflows-fips, aactl, external-secrets-operator-fips, snyk-cli, kuma, cloudbeat, prometheus-elasticsearch-exporter, kubernetes-fips, kyverno, seaweedfs-rocksdb, terraform, skaffold,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-fips, etcd, kyverno-fips, kots, upwind-agent, argo-workflows-fips, aactl, external-secrets-operator-fips, snyk-cli, kuma, cloudbeat, prometheus-elasticsearch-exporter, kubernetes-fips, kyverno, seaweedfs-rocksdb, terraform, skaffold,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: trivy-fips, melange, pulumi-language-yaml, flux-notification-controller-fips, crossplane-provider-azure-authorization, etcd, kyverno-fips, ksops, grype-db, kots, upwind-agent, syft, tekton-chains-fips, crossplane-provider-azure-spring, step, argo-workflows-fips,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: trivy-fips, melange, pulumi-language-yaml, etcd, kyverno-fips, grype-db, kots, upwind-agent, syft, argo-workflows-fips, amazon-ssm-agent, docker-fips, aactl, nuclei, gitlab-runner, external-secrets-operator-fips, syft-fips, snyk-cli, kuma, mapotf-fips, cloudbeat,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: trivy-fips, melange, pulumi-language-yaml, flux-notification-controller-fips, crossplane-provider-azure-authorization, etcd, kyverno-fips, ksops, grype-db, kots, upwind-agent, syft, tekton-chains-fips, crossplane-provider-azure-spring, step, argo-workflows-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect-fips, melange, pulumi-language-yaml, flux-notification-controller-fips, step, docker-machine-driver-linode, crossplane-provider-aws-route53-fips, syft-fips, crossplane-provider-aws-ec2, crossplane-provider-aws-s3control,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: trivy-fips, melange, pulumi-language-yaml, etcd, kyverno-fips, grype-db, kots, upwind-agent, syft, argo-workflows-fips, amazon-ssm-agent, aactl, nuclei, external-secrets-operator-fips, syft-fips, snyk-cli, kuma, mapotf-fips, cloudbeat, argo-events, guac,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect-fips, melange, pulumi-language-yaml, flux-notification-controller-fips, step, docker-machine-driver-linode, crossplane-provider-aws-route53-fips, syft-fips, crossplane-provider-aws-ec2, crossplane-provider-aws-s3control,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: trivy-fips, melange, pulumi-language-yaml, etcd, kyverno-fips, grype-db, kots, upwind-agent, syft, argo-workflows-fips, amazon-ssm-agent, docker-fips, aactl, nuclei, gitlab-runner, external-secrets-operator-fips, syft-fips, snyk-cli, kuma, mapotf-fips, cloudbeat,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: ksops, containerd, guac, slsa-verifier, cilium, hcloud, atlantis, gomplate, opentelemetry-collector, buildkitd, gptscript, mods, sops, apko, go-discover, witness, docker-machine-driver-harvester, step-kms-plugin, melange, nerdctl, external-dns, zot, chezmoi,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-operator, kubernetes, external-secrets-operator, helm, minio, containerd, falco-no-driver, prometheus-operator, kaf, skaffold, spire-server, telegraf, aactl, flux, flux-image-automation-controller, k9s, kine, cilium, mattermost, cloud-provider-aws, fscrypt,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-operator, kubernetes, external-secrets-operator, helm, minio, containerd, falco-no-driver, prometheus-operator, kaf, skaffold, spire-server, telegraf, aactl, flux, flux-image-automation-controller, k9s, kine, cilium, mattermost, cloud-provider-aws, fscrypt,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: ksops, containerd, guac, slsa-verifier, cilium, hcloud, atlantis, gomplate, opentelemetry-collector, buildkitd, gptscript, mods, sops, apko, go-discover, witness, docker-machine-driver-harvester, step-kms-plugin, melange, nerdctl, external-dns, zot, chezmoi,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: containerd, guac, cilium, gomplate, opentelemetry-collector, gptscript, apko, go-discover, witness, docker-machine-driver-harvester, step-kms-plugin, melange, nerdctl, external-dns, zot, chezmoi, cilium-cli, rancher, step, kubernetes, external-secrets-operator,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, argo-events, trivy-operator, kubernetes, external-secrets-operator, helm, grype, minio, containerd, falco-no-driver, prometheus-operator, kaf, skaffold, spire-server, telegraf, guac, aactl, flux, opentofu, flux-image-automation-controller,...

OPENSUSE-SU-2026:21072-1 Security update for trivy

This update for trivy fixes the following issues Update to version 0.71.2: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption bsc1267268. - CVE-2026-46680:...