Vulnerabilities

TI-2026-66156 CVE-2026-104994 · GHSA-fr63-55g9-p68v

Path traversal in Aquasecurity Trivy

LOW 12

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root.

CVSS 3.1LOW 2.5 Local Low privileges No interaction EPSS 0.00197 Published 2026-10-02 Fixed in 0.71.0 CWE-24

TI-2026-45161 CVE-2026-63328 · GHSA-8rc5-4fr6-64pw

LOW 29

Trivy is a security scanner.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.0019 Published 2026-08-18 Fixed in 0.72.0 CWE-22

TI-2026-39311 CVE-2026-54448 · GHSA-q3fv-x8vg-qqm4

MEDIUM 64

Trivy is a security scanner.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00443 Published 2026-06-25 Fixed in 0.71.0 CWE-770

TI-2026-39796 CVE-2026-55092 · GHSA-mcj4-mphf-j9ff

LOW 31

Trivy is a security scanner.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00442 Published 2026-06-25 Fixed in 0.71.1 CWE-22

TI-2026-26015 CVE-2026-33634 · GHSA-69fq-xp46-6x23

CRITICAL 100KEV

Trivy is a security scanner.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.59727 Published 2026-03-23 Fixed in 0.2.6, 0.35.0 CWE-506

TI-2026-22633 CVE-2026-28353

MEDIUM 49

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00507 Published 2026-03-05 No fix listed CWE-506

TI-2026-21180 CVE-2026-26189 · GHSA-9p44-j4g5-cfx5

MEDIUM 40

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01508 Published 2026-02-19 Fixed in 0.34.0 CWE-78

TI-2024-23265 CVE-2024-35192 · GHSA-xcq4-m2r3-cmrj

LOW 24

Trivy is a security scanner.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0019 Published 2024-05-20 Fixed in 0.51.2 CWE-522