Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GO-2026-6294
  • Go/github.com/aquasecurity/trivy
 Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy 26 Aug
  • Fix available
GHSA-mcj4-mphf-j9ff
  • Go/github.com/aquasecurity/trivy
 Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts 25 Aug
  • Fix available
  • Severity - 7.0 (High)
GO-2026-6250
  • Go/github.com/aquasecurity/trivy
 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy 25 Aug
  • Fix available
GHSA-8rc5-4fr6-64pw
  • Go/github.com/aquasecurity/trivy
 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write 18 Aug
  • Fix available
  • Severity - 6.8 (Medium)
CVE-2026-63328
  • github.com/aquasecurity/trivy
 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write 18 Aug
  • Fix available
  • Severity - 6.8 (Medium)
GO-2026-5983
  • Go/github.com/aquasecurity/trivy
 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy 27 Jul
  • Fix available
GHSA-q3fv-x8vg-qqm4
  • Go/github.com/aquasecurity/trivy
 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser 14 Jul
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-54448
  • github.com/aquasecurity/trivy
 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser 25 Jun
  • Fix available
  • Severity - 6.9 (Medium)
CVE-2026-55092
  • github.com/aquasecurity/trivy
 Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts 25 Jun
  • Fix available
  • Severity - 7.0 (High)
GO-2026-4919
  • Go/github.com/aquasecurity/trivy
 Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy 01 Apr
  • No fix available
GHSA-69fq-xp46-6x23
  • GitHub Actions/aquasecurity/setup-trivy
  • GitHub Actions/aquasecurity/trivy-action
  • Go/github.com/aquasecurity/trivy
 Trivy ecosystem supply chain was briefly compromised 24 Mar
  • Fix available
  • Severity - 9.4 (Critical)
CVE-2026-33634
  • github.com/aquasecurity/setup-trivy
  • github.com/aquasecurity/trivy
  • github.com/aquasecurity/trivy-action
  • github.com/team-telnyx/telnyx-python
 Trivy ecosystem supply chain briefly compromised 23 Mar
  • Fix available
  • Severity - 9.4 (Critical)
CVE-2026-26189
  • github.com/aquasecurity/trivy-action
 Trivy Action has a script injection via sourced env file in composite action 19 Feb
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-9p44-j4g5-cfx5
  • GitHub Actions/aquasecurity/trivy-action
 Trivy Action has a script injection via sourced env file in composite action 18 Feb
  • Fix available
  • Severity - 5.9 (Medium)
GO-2024-2870
  • Go/github.com/aquasecurity/trivy
 Credential leakage in github.com/aquasecurity/trivy 22 May 2024
  • Fix available
CVE-2024-35192
  • github.com/aquasecurity/trivy
 Trivy possibly leaks registry credential when scanning images from malicious registries 20 May 2024
  • Fix available
  • Severity - 5.5 (Medium)
Load more...