docker.io/aquasec/trivy:0.72.0 linux/amd64

docker.io/aquasec/trivy:0.72.0 - Trivy安全扫描结果扫描时间: 2026-07-14 13:56

全部漏洞信息

低危漏洞:2

中危漏洞:10

高危漏洞:16

严重漏洞:0

系统OS: alpine 3.24.1 扫描引擎: Trivy 扫描时间: 2026-07-14 13:56

docker.io/aquasec/trivy:0.72.0 (alpine 3.24.1) (alpine)

低危漏洞:1

中危漏洞:5

高危漏洞:13

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
c-ares	CVE-2026-33630	高危	1.34.6-r0	1.34.8-r0	c-ares: c-ares: Use-after-free / double-free in query-completion handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-33630 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
libcurl	CVE-2026-11352	高危	8.20.0-r1	8.21.0-r0	curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11352 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 18:01
libcurl	CVE-2026-11586	高危	8.20.0-r1	8.21.0-r0	curl: curl: Denial of Service via WebSocket PING flood 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11586 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 17:59
libcurl	CVE-2026-12064	高危	8.20.0-r1	8.21.0-r0	curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-12064 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 19:43
libcurl	CVE-2026-8286	高危	8.20.0-r1	8.21.0-r0	curl: curl: Insecure connection establishment due to TLS configuration mismatch 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8286 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 19:42
libcurl	CVE-2026-8925	高危	8.20.0-r1	8.21.0-r0	curl: curl: Double-free vulnerability in SASL authentication 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8925 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:04
libcurl	CVE-2026-8927	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Information disclosure due to uncleared proxy authentication state 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8927 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:21
libcurl	CVE-2026-8932	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8932 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:18
libcurl	CVE-2026-9079	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9079 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 15:05
libcurl	CVE-2026-9080	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9080 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 15:05
libcurl	CVE-2026-9545	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Information disclosure via cached SSL session and early data 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9545 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 15:03
libcurl	CVE-2026-9546	高危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Information disclosure due to persistent Referer header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9546 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 14:53
libcurl	CVE-2026-9547	高危	8.20.0-r1	8.21.0-r0	curl: curl: Man-in-the-middle attack via SSH host key bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-9547 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 14:52
libcurl	CVE-2026-10536	中危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-10536 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 18:02
libcurl	CVE-2026-11564	中危	8.20.0-r1	8.21.0-r0	libcurl: libcurl: Certificate validation bypass due to incorrect connection reuse 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11564 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 18:00
libcurl	CVE-2026-11856	中危	8.20.0-r1	8.21.0-r0	curl: curl: Information disclosure via incorrect Digest authentication header reuse 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-11856 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 19:43
libcurl	CVE-2026-8924	中危	8.20.0-r1	8.21.0-r0	curl: curl: Cookie injection via malicious HTTP server using super cookies 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8924 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:06
libcurl	CVE-2026-8926	中危	8.20.0-r1	8.21.0-r0	curl: curl: Information disclosure via incorrect .netrc password lookup 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8926 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:02
libcurl	CVE-2026-8458	低危	8.20.0-r1	8.21.0-r0	libcurl might in some circumstances reuse the wrong connection when as ... 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8458 镜像层: sha256:2901ffecd6da3fe37e4c1fc2bd2f2fae88b598ca7eece8398ba592e7b919fc79 发布日期: 2026-07-03 07:16 修改: 2026-07-07 23:12

usr/local/bin/trivy (gobinary)

低危漏洞:1

中危漏洞:5

高危漏洞:3

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
oras.land/oras-go/v2	CVE-2026-50151	高危	v2.6.0	2.6.1	oras-go blob upload vulnerable to credential forwarding via unvalidated Location header 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50151 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
oras.land/oras-go/v2	CVE-2026-50163	高危	v2.6.0		`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50163 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
stdlib	CVE-2026-39822	高危	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-39822 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 2026-07-08 17:17 修改: 2026-07-10 18:57
github.com/sigstore/timestamp-authority/v2	CVE-2026-49835	中危	v2.0.6	2.1.0	Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49835 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
oras.land/oras-go/v2	CVE-2026-50162	中危	v2.6.0	2.6.1	oras-go has file store write outside workingDir via symlink traversal 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50162 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
oras.land/oras-go/v2	GHSA-vh4v-2xq2-g5cg	中危	v2.6.0	2.6.1	ORAS Go forwards registry credentials across registry redirects 漏洞详情: https://github.com/advisories/GHSA-vh4v-2xq2-g5cg 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 2026-07-01 21:54 修改: 2026-07-01 21:54
github.com/sigstore/sigstore-go	CVE-2026-49834	中危	v1.1.4	1.2.0	sigstore-go has a multi-log threshold bypass via single compromised log 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49834 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
stdlib	CVE-2026-42505	中危	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-42505 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 2026-07-08 17:17 修改: 2026-07-10 18:57
oras.land/oras-go/v2	CVE-2026-48978	低危	v2.6.0	2.6.1	oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-48978 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00
golang.org/x/crypto	GO-2026-5932	未知	v0.53.0		The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues 漏洞详情: 镜像层: sha256:881c537197a7e99d4d02dfb59eea209513f0c7b0b432e8f33ebb5b55f6e0d3af 发布日期: 0001-01-01 00:00 修改: 0001-01-01 00:00