Priority MEDIUM 40
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00442 · Published 2026-07-28 · Fixed in 5.27.2, 6.0.1 CWE-648
Priority LOW 30
Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00423 · Published 2026-03-26 · Fixed in 1.42.3 CWE-460
Priority LOW 39
Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API.
CVSS 4.0HIGH 8.5· Adjacent network · Low privileges · No interaction · EPSS 0.00343 · Published 2026-03-12 · Fixed in 5.25.1 CWE-89
Priority LOW 24
Quill provides simple mac binary signing and notarization from any platform.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00114 · Published 2026-03-11 · Fixed in 0.7.1 CWE-770
Priority LOW 23
Quill provides simple mac binary signing and notarization from any platform.
CVSS 3.1MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00099 · Published 2026-03-11 · Fixed in 0.7.1 CWE-770
Priority LOW 23
Quill provides simple mac binary signing and notarization from any platform.
CVSS 3.1MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00095 · Published 2026-03-11 · Fixed in 0.7.1 CWE-918
Priority LOW 35
Grype is a vulnerability scanner for container images and filesystems.
CVSS 4.0HIGH 8.2· Local · No auth · No interaction · EPSS 0.0016 · Published 2025-11-25 · Fixed in 0.104.1 CWE-212
Priority HIGH 75
stereoscope is a go library for processing container images and simulating a squash filesystem.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00393 · Published 2024-01-31 · Fixed in 0.0.1 CWE-22
Priority HIGH 66
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00791 · Published 2023-02-07 · Fixed in 0.70.0 CWE-200
Priority LOW 34
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00701 · Published 2022-07-20 · Fixed in 4.0.1, 0.1.5 CWE-522
Priority MEDIUM 46
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01836 · Published 2020-05-27 · No fix listed CWE-114
Priority LOW 30
An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00874 · Published 2018-08-01 · Fixed in 1.0.17 CWE-200
THREATIST.IORead the docs