CVE-2026-63328

Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...

EUVD-2026-60957

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

GO-2024-2958 vulnerabilities

Vulnerabilities for packages: zot, harbor-scanner-trivy, harbor-scanner-trivy-fips...

GO-2026-5983 vulnerabilities

Vulnerabilities for packages: trivy-operator, trivy-operator-fips, cloudbeat-fips, cloudbeat...

GO-2024-2948 vulnerabilities

Vulnerabilities for packages: kots, trivy, tflint, zarf, conftest, wolfictl, terragrunt, conftest-fips, kubescape, tfsec, terraform, grype, k9s, zot, snyk-cli, trivy-fips...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: kots, trivy, flux-source-controller, zarf, chartmuseum, flux-helm-controller, kubevela, eksctl, cilium-cli, kubescape, helm-push, zot, k8sgpt, k9s, helm-operator, up...

GO-2026-5058 vulnerabilities

Vulnerabilities for packages: task, cloudbeat-fips, conftest, trivy-operator, wolfictl, k9s-fips, terragrunt, kubescape-server-fips, conftest-fips, tflint-fips, opentofu, syft, terraform, tfsec, kubescape-server, grype-db, zot, trivy-fips, crossplane-provider-terraform,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: helm-operator-fips, flux-fips, flux-source-controller, pluto-fips, trivy-operator, flux-helm-controller, flux-source-controller-fips, k9s-fips, eksctl, cilium-cli, helm-push, zot, headlamp, cert-manager-cmctl-fips, pluto, k8sgpt, consul-k8s-fips, helm-docs,...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: kots, trivy, flux-source-controller, zarf, chartmuseum, flux-helm-controller, kubevela, eksctl, cilium-cli, kubescape, helm-push, zot, k8sgpt, k9s, helm-operator, up...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, helm-operator-fips, zot, cloudbeat-fips, flux-fips, flux-source-controller, pluto-fips, trivy-operator, flux-source-controller-fips, k9s-fips, eksctl, cilium-cli, kubescape-server-fips, tigera-operator-fips, chaos-mesh, helm-exporter,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: helm-operator-fips, flux-fips, flux-source-controller, flux-helm-controller, flux-source-controller-fips, rancher-helm, eksctl, cilium-cli, helm-push, cert-manager-cmctl-fips, pluto, consul-k8s-fips, helm-docs, cluster-api-helm-controller-fips, chart-testing,...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: skaffold, cloudbeat-fips, conftest, trivy-operator, kubescape-server-fips, conftest-fips, livekit-cli, osv-scanner, kubescape-server, docker-compose, zot, skaffold-fips, kaniko, trivy-fips, kaniko-fips, docker-fips, podman-fips, cloudbeat, buildah-fips,...

GO-2024-2491 vulnerabilities

Vulnerabilities for packages: skaffold, docker, wolfictl, newrelic-infrastructure-agent, syft, buildkitd, zot, kaniko, runc, zarf, cadvisor, kubescape, grype, k9s, k3d, kubernetes, kots, ctop, trivy, nerdctl, k3s, skopeo, podman...

GO-2024-2492 vulnerabilities

Vulnerabilities for packages: skaffold, trivy, scorecard, docker, conftest, guac, conftest-fips, kubescape, buildkitd, zot, kaniko...

GO-2024-2497 vulnerabilities

Vulnerabilities for packages: skaffold, trivy, scorecard, docker, conftest, guac, conftest-fips, kubescape, buildkitd, zot, kaniko...

GO-2024-2493 vulnerabilities

Vulnerabilities for packages: skaffold, trivy, scorecard, docker, conftest, guac, conftest-fips, kubescape, buildkitd, zot, kaniko...

GO-2024-2494 vulnerabilities

Vulnerabilities for packages: skaffold, trivy, scorecard, docker, conftest, guac, conftest-fips, kubescape, buildkitd, zot, kaniko...

GO-2026-4858 vulnerabilities

Vulnerabilities for packages: skaffold, cloudbeat-fips, conftest, trivy-operator, kubescape-server-fips, conftest-fips, livekit-cli, osv-scanner, kubescape-server, docker-compose, zot, skaffold-fips, kaniko, trivy-fips, kaniko-fips, docker-fips, podman-fips, cloudbeat, buildah-fips,...

GO-2025-3528 vulnerabilities

Vulnerabilities for packages: opa-envoy, helm-operator-fips, skaffold, neuvector-fips, flux-source-controller, docker, flux-helm-controller, flux-source-controller-fips, neuvector-scanner, newrelic-infrastructure-agent, eksctl, cilium-cli, rancher, syft, buildkitd, neuvector, helm-push,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, trivy-operator, eksctl, kubescape-server-fips, helm-push, kubescape-server, cert-manager-cmctl-fips, gatekeeper, kyverno-fips, kyverno-notation-aws, drone-fips, rancher-fleet, steampipe, kubescape-operator-fips, vcluster, zarf-fips, kargo,...