Read the docs

anchore

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

anchore records in CISA KEV

No anchore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Quill 3 records LOW Syft 2 records HIGH Anchore 1 record LOW Anchorectl 1 record LOW Container Image Scanner 1 record LOW Engine 1 record MEDIUM Stereoscope 1 record HIGH

Records

12 records

TI-2020-08949 CVE-2020-11075

Shell Escape in Anchore Engine

Priority MEDIUM 46

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01836 Published 2020-05-27 No fix listed CWE-114
TI-2026-45314 CVE-2026-63727 · GHSA-4r98-xr3x-v6v8

Anchore Enterprise Privilege Escalation via User Management API

Priority MEDIUM 40

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-07-28 Fixed in 5.27.2, 6.0.1 CWE-648
TI-2026-20256 CVE-2026-25076 · GHSA-qgpf-49hm-qfx7

Anchore Enterprise GraphQL Reports API SQL injection

Priority LOW 39

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API.

CVSS 4.0HIGH 8.5 Adjacent network Low privileges No interaction EPSS 0.00343 Published 2026-03-12 Fixed in 5.25.1 CWE-89
TI-2026-25877 CVE-2026-33481 · GHSA-rjcw-vg7j-m9rc

Syft improper temporary file cleanup

Priority LOW 30

Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00423 Published 2026-03-26 Fixed in 1.42.3 CWE-460
TI-2018-16174 CVE-2018-1999033 · GHSA-w9v7-7mq5-p27c

An exposure of sensitive information vulnerability exists in Jenkins Anchore Container…

Priority LOW 30

An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00874 Published 2018-08-01 Fixed in 1.0.17 CWE-200
Open these records in search →