trivy
v0.76.2Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
- Maintenance
- Active152 commits in 3 months · bus factor 3
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 5 advisories1 critical, 1 high, 3 medium · Scorecard 6.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
39.4k stars · 885 forks · 315 open issues · last release 10 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 5 most recent advisories published by the maintainers: 1 critical, 1 high, 3 medium. Check the patched version against the one you run.
- mediumCVE-2026-63328Jun 30, 2026Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
- Affected
- <0.72.0
- Patched in
- 0.72.0
- highCVE-2026-55092Jun 15, 2026Path traversal via a crafted vulnerability database or other downloaded artifacts
- Affected
- <0.71.1
- Patched in
- 0.71.1
- mediumCVE-2026-54448Jun 4, 2026Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
- Affected
- <0.71.0
- Patched in
- 0.71.0
- criticalCVE-2026-33634Mar 21, 2026Trivy ecosystem supply chain temporarily compromised
- Affected
- =0.69.4; <0.35.0; <0.2.6
- Patched in
- 0.69.3; 0.35.0; 0.2.6
- mediumCVE-2024-35192May 20, 2024Possible registry credential leakage when scanning images from malicious registries
- Affected
- < 0.51.2
- Patched in
- 0.51.2