Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/aquasecurity/trivy

5 known vulnerabilities (1 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
v0.76.2 (Nov 5, 2026): affected by CVE-2026-33634
Newest unaffected release
Every release is affected by at least one advisory
Advisories
5 · 1 critical, 1 high, 3 medium
Releases
174 since v0.1.5 (Aug 19, 2019)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-63328Medium 6.8

    Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

    Affected: fixed in 0.72.0.

    Fixed in v0.72.0 (released Jun 30, 2026, 49 days before disclosure).

    The latest release, v0.76.2, is not affected.

  • CVE-2026-54448Medium 6.9

    Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

    Affected: fixed in 0.71.0.

    Fixed in v0.71.0 (released Jun 1, 2026, 24 days before disclosure).

    The latest release, v0.76.2, is not affected.

  • Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

    Affected: fixed in 0.71.1.

    Fixed in v0.71.1 (released Jun 10, 2026, 15 days before disclosure).

    The latest release, v0.76.2, is not affected.

  • CVE-2026-33634Critical 9.4 · KEV

    Trivy ecosystem supply chain briefly compromised

    Affected: from 0.69.4; versions 0.69.4.

    No fix released. The latest release, v0.76.2, is still affected.

  • CVE-2024-35192Medium 5.5

    Trivy possibly leaks registry credential when scanning images from malicious registries

    Affected: fixed in 0.51.2.

    Fixed in v0.51.2 (released May 20, 2024, the day of disclosure).

    The latest release, v0.76.2, is not affected.