Known vulnerabilities in trivy

Software: trivy
Software CPE: cpe:2.3:a:aquasecurity:trivy:*:*:*:*:*:*:*:*
Total vulnerabilities: 10
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting trivy trivy is affected by 10 known vulnerabilities: 1 critical, 7 medium, 2 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136054 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-63328
CWE-22 Medium
No
No
0.72.0 01.07.2026 SB2026070146
#VU134535 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-55092
CWE-22 Low
No
No
0.71.1 15.06.2026 SB2026061546
#VU134534 - Resource exhaustion
CVE-2026-54448
CWE-400 Low
No
No
0.71.0 15.06.2026 SB2026061545
#VU124689 - Embedded Malicious Code
CVE-2026-33634
CWE-506 Critical
No
Exploited
- 30.03.2026 SB2026033044
#VU97217 - Resource exhaustion
CVE-2024-34158
CWE-400 Medium
No
No
0.56.0 12.09.2024 SB2024091261
SB2024091264
SB2024091265
and 76 more
#VU97216 - Resource exhaustion
CVE-2024-34156
CWE-400 Medium
No
No
0.56.0 12.09.2024 SB2024091261
SB2024091264
SB2024091265
and 143 more
#VU97215 - Resource exhaustion
CVE-2024-34155
CWE-400 Medium
No
No
0.56.0 12.09.2024 SB2024091261
SB2024091264
SB2024091265
and 81 more
#VU128413 - Insufficiently Protected Credentials
CVE-2024-35192
CWE-522 Medium
No
No
0.51.2 20.05.2024 SB2024052091
#VU60972 - Permissions, Privileges, and Access Controls
CVE-2022-23648
CWE-264 Medium
Available
No
0.26.0 03.03.2022 SB2022030305
SB2022030722
SB2022030725
and 30 more
#VU54999 - Permissions, Privileges, and Access Controls
CVE-2021-32760
CWE-264 Medium
No
No
0.20.0 20.07.2021 SB2021072005
SB2021072227
SB2021072708
and 17 more