Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:aquasec:trivy:*:*:*:*:*:go:*:*

2 briefs RSS
high advisory

Path Traversal in Trivy via OCI Artifact Annotation

Trivy versions prior to 0.71.1 are vulnerable to arbitrary file write via path traversal in OCI artifact titles, allowing attackers to overwrite files if a user is directed to an untrusted OCI registry.

Trivy
2t 1c
low advisory

Trivy Unbounded Read Leads to Denial of Service via Helm Chart Tar Bomb

Trivy versions prior to 0.71.0 are vulnerable to CVE-2026-54448, a denial-of-service attack where a crafted Helm chart archive (.tgz) can cause unbounded memory consumption, leading to the OS OOM killer terminating the Trivy process and other services on the host or CI runner.

Trivy supply-chain vulnerability denial-of-service ci-cd
1t 1c