Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/anchore/syft

2 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2 · 2 medium
Registry
pkg.go.dev

Advisories 2

  • CVE-2026-33481Medium 5.3

    Syft improper temporary file cleanup

    Affected: fixed in 1.42.3.

  • CVE-2023-24827Medium 6.5

    Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft

    Affected: from 0.69.0, fixed in 0.70.0.