SAFE

SAFE SAFE performs controlled, repository-aware security assessment of Semgrep and Trivy findings in research artifacts. It supports two independent classification tasks: direct binary prediction SECURITYRELEVANT or NONSECURITY and the detailed multiclass contextual taxonomy three labels — see...

OPENSUSE-SU-2026:11691-1 trivy-0.74.0-3.1 on GA media

These are all security issues fixed in the trivy-0.74.0-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11676-1 trivy-0.74.0-2.1 on GA media

These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed...

Security update for trivy (moderate)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0312-1 Rating: moderate References: 1276128 Cross-References: CVE-2026-72815 CVE-2026-72816 CVE-2026-72817 CVSS scores: CVE-2026-72815 SUSE: 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21645-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21645-1 advisory. This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing...

GO-2026-6294 Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy

Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

GHSA-MCJ4-MPHF-J9FF Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

GO-2026-6250 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy...

OPENSUSE-SU-2026:21645-1 Security update for trivy

This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery bsc1276128. Changes for trivy: - Update to version 0.74.0: release:...

OPENSUSE-SU-2026:11578-1 trivy-0.74.0-1.1 on GA media

These are all security issues fixed in the trivy-0.74.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-80626

These are all security issues fixed in the trivy-0.74.0-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: goreleaser, kyverno-notation-aws, falcoctl, tekton-chains, kubescape, crossplane, spire-server, aactl, skaffold, tkn, policy-controller, trivy, zot, ko, kyverno, flux-source-controller, zarf, neuvector-sigstore-interface, trivy-operator...

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...