OPENSUSE-SU-2026:10651-1

Vulnerability from csaf_opensuse - Published: 2026-04-28 00:00 - Updated: 2026-04-28 00:00
Summary
trivy-0.70.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: trivy-0.70.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the trivy-0.70.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10651
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-69725
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-25934
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-33186
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-33747
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-33748
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-34986
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-39984
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "trivy-0.70.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the trivy-0.70.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10651",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10651-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-69725 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-69725/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25934 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25934/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33747 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33747/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33748 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33748/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39984 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39984/"
      }
    ],
    "title": "trivy-0.70.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-28T00:00:00Z",
      "generator": {
        "date": "2026-04-28T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10651-1",
      "initial_release_date": "2026-04-28T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-28T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0.70.0-1.1.aarch64",
                "product": {
                  "name": "trivy-0.70.0-1.1.aarch64",
                  "product_id": "trivy-0.70.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0.70.0-1.1.ppc64le",
                "product": {
                  "name": "trivy-0.70.0-1.1.ppc64le",
                  "product_id": "trivy-0.70.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0.70.0-1.1.s390x",
                "product": {
                  "name": "trivy-0.70.0-1.1.s390x",
                  "product_id": "trivy-0.70.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0.70.0-1.1.x86_64",
                "product": {
                  "name": "trivy-0.70.0-1.1.x86_64",
                  "product_id": "trivy-0.70.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0.70.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64"
        },
        "product_reference": "trivy-0.70.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0.70.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le"
        },
        "product_reference": "trivy-0.70.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0.70.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x"
        },
        "product_reference": "trivy-0.70.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0.70.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        },
        "product_reference": "trivy-0.70.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-69725",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-69725"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An Open Redirect vulnerability in the go-chi/chi \u003e=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-69725",
          "url": "https://www.suse.com/security/cve/CVE-2025-69725"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258511 for CVE-2025-69725",
          "url": "https://bugzilla.suse.com/1258511"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-69725"
    },
    {
      "cve": "CVE-2026-25934",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25934"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25934",
          "url": "https://www.suse.com/security/cve/CVE-2026-25934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258093 for CVE-2026-25934",
          "url": "https://bugzilla.suse.com/1258093"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-25934"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33747",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33747"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33747",
          "url": "https://www.suse.com/security/cve/CVE-2026-33747"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260954 for CVE-2026-33747",
          "url": "https://bugzilla.suse.com/1260954"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33747"
    },
    {
      "cve": "CVE-2026-33748",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33748"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33748",
          "url": "https://www.suse.com/security/cve/CVE-2026-33748"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261046 for CVE-2026-33748",
          "url": "https://bugzilla.suse.com/1261046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33748"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    },
    {
      "cve": "CVE-2026-39984",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39984"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
          "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39984",
          "url": "https://www.suse.com/security/cve/CVE-2026-39984"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262338 for CVE-2026-39984",
          "url": "https://bugzilla.suse.com/1262338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.aarch64",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.ppc64le",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.s390x",
            "openSUSE Tumbleweed:trivy-0.70.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-28T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39984"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.