OPENSUSE-SU-2026:21072-1
Vulnerability from csaf_opensuse - Published: 2026-06-26 09:25 - Updated: 2026-09-17 17:36Summary
Security update for trivy
Severity
Important
Notes
Title of the patch: Security update for trivy
Description of the patch: This update for trivy fixes the following issues
Update to version 0.71.2:
- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite
loops, panics or resource consumption (bsc#1267268).
- CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot
evasion (bsc#1268356).
- CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously
crafted image (bsc#1268440).
- CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's
configuration (bsc#1268399).
- CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation
(bsc#1268400).
- CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked
path (bsc#1268404).
- CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted
checkpoint image metadata during container restoration (bsc#1268403).
Changes for trivy:
* release: v0.71.2 [release/v0.71] (#10871)
* fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
* chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
* fix(oci): validate artifact filename
* fix: forward ospkg detector options through ospkg.NewScanner
* fix(vex): load VEX documents from within the repository
directory
* fix: surface the original analysis error instead of context
cancellation
* ci: expect GitHub App bot as backport PR author
Patchnames: openSUSE-Leap-16.0-1094
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
important
8.8 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2026-44740
Threats
Impact
important
References
32 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for trivy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for trivy fixes the following issues\n\nUpdate to version 0.71.2:\n\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n loops, panics or resource consumption (bsc#1267268).\n- CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot\n evasion (bsc#1268356).\n- CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously\n crafted image (bsc#1268440).\n- CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image\u0027s\n configuration (bsc#1268399).\n- CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation\n (bsc#1268400).\n- CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked\n path (bsc#1268404).\n- CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted\n checkpoint image metadata during container restoration (bsc#1268403).\n\nChanges for trivy:\n\n * release: v0.71.2 [release/v0.71] (#10871)\n * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)\n * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)\n * fix(oci): validate artifact filename\n * fix: forward ospkg detector options through ospkg.NewScanner\n * fix(vex): load VEX documents from within the repository\n directory\n * fix: surface the original analysis error instead of context\n cancellation\n * ci: expect GitHub App bot as backport PR author\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1094",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21072-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1267268",
"url": "https://bugzilla.suse.com/1267268"
},
{
"category": "self",
"summary": "SUSE Bug 1268356",
"url": "https://bugzilla.suse.com/1268356"
},
{
"category": "self",
"summary": "SUSE Bug 1268399",
"url": "https://bugzilla.suse.com/1268399"
},
{
"category": "self",
"summary": "SUSE Bug 1268400",
"url": "https://bugzilla.suse.com/1268400"
},
{
"category": "self",
"summary": "SUSE Bug 1268403",
"url": "https://bugzilla.suse.com/1268403"
},
{
"category": "self",
"summary": "SUSE Bug 1268404",
"url": "https://bugzilla.suse.com/1268404"
},
{
"category": "self",
"summary": "SUSE Bug 1268440",
"url": "https://bugzilla.suse.com/1268440"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44740 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44740/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47262 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47262/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-50195 page",
"url": "https://www.suse.com/security/cve/CVE-2026-50195/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53488 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53488/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53489 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53489/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53492 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53492/"
}
],
"title": "Security update for trivy",
"tracking": {
"current_release_date": "2026-09-17T17:36:03Z",
"generator": {
"date": "2026-06-26T09:25:10Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21072-1",
"initial_release_date": "2026-06-26T09:25:10Z",
"revision_history": [
{
"date": "2026-06-26T09:25:10Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:38:48Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:41:07Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-17T08:58:53Z",
"number": "4",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:36:03Z",
"number": "5",
"summary": "unknown changes"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "trivy-0:0.71.2-160000.1.1.aarch64",
"product": {
"name": "trivy-0:0.71.2-160000.1.1.aarch64",
"product_id": "trivy-0:0.71.2-160000.1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/trivy@0.71.2-160000.1.1?arch=aarch64\u0026upstream=trivy-0:0.71.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0:0.71.2-160000.1.1.ppc64le",
"product": {
"name": "trivy-0:0.71.2-160000.1.1.ppc64le",
"product_id": "trivy-0:0.71.2-160000.1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/trivy@0.71.2-160000.1.1?arch=ppc64le\u0026upstream=trivy-0:0.71.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0:0.71.2-160000.1.1.s390x",
"product": {
"name": "trivy-0:0.71.2-160000.1.1.s390x",
"product_id": "trivy-0:0.71.2-160000.1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/trivy@0.71.2-160000.1.1?arch=s390x\u0026upstream=trivy-0:0.71.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0:0.71.2-160000.1.1.x86_64",
"product": {
"name": "trivy-0:0.71.2-160000.1.1.x86_64",
"product_id": "trivy-0:0.71.2-160000.1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/trivy@0.71.2-160000.1.1?arch=x86_64\u0026upstream=trivy-0:0.71.2-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0:0.71.2-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64"
},
"product_reference": "trivy-0:0.71.2-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0:0.71.2-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le"
},
"product_reference": "trivy-0:0.71.2-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0:0.71.2-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x"
},
"product_reference": "trivy-0:0.71.2-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0:0.71.2-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
},
"product_reference": "trivy-0:0.71.2-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44740",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44740"
}
],
"notes": [
{
"category": "general",
"text": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44740",
"url": "https://www.suse.com/security/cve/CVE-2026-44740"
},
{
"category": "external",
"summary": "SUSE Bug 1267264 for CVE-2026-44740",
"url": "https://bugzilla.suse.com/1267264"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "important"
}
],
"title": "CVE-2026-44740"
},
{
"cve": "CVE-2026-46680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46680"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46680",
"url": "https://www.suse.com/security/cve/CVE-2026-46680"
},
{
"category": "external",
"summary": "SUSE Bug 1268355 for CVE-2026-46680",
"url": "https://bugzilla.suse.com/1268355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "important"
}
],
"title": "CVE-2026-46680"
},
{
"cve": "CVE-2026-47262",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47262"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47262",
"url": "https://www.suse.com/security/cve/CVE-2026-47262"
},
{
"category": "external",
"summary": "SUSE Bug 1268405 for CVE-2026-47262",
"url": "https://bugzilla.suse.com/1268405"
},
{
"category": "external",
"summary": "SUSE Bug 1280874 for CVE-2026-47262",
"url": "https://bugzilla.suse.com/1280874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "moderate"
}
],
"title": "CVE-2026-47262"
},
{
"cve": "CVE-2026-50195",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-50195"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image\u0027s configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node\u0027s local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker\u0027s malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod\u0027s identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-50195",
"url": "https://www.suse.com/security/cve/CVE-2026-50195"
},
{
"category": "external",
"summary": "SUSE Bug 1268399 for CVE-2026-50195",
"url": "https://bugzilla.suse.com/1268399"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "important"
}
],
"title": "CVE-2026-50195"
},
{
"cve": "CVE-2026-53488",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53488"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53488",
"url": "https://www.suse.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "SUSE Bug 1268400 for CVE-2026-53488",
"url": "https://bugzilla.suse.com/1268400"
},
{
"category": "external",
"summary": "SUSE Bug 1280874 for CVE-2026-53488",
"url": "https://bugzilla.suse.com/1280874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "important"
}
],
"title": "CVE-2026-53488"
},
{
"cve": "CVE-2026-53489",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53489"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53489",
"url": "https://www.suse.com/security/cve/CVE-2026-53489"
},
{
"category": "external",
"summary": "SUSE Bug 1268404 for CVE-2026-53489",
"url": "https://bugzilla.suse.com/1268404"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "moderate"
}
],
"title": "CVE-2026-53489"
},
{
"cve": "CVE-2026-53492",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53492"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod\u0027s create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53492",
"url": "https://www.suse.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "SUSE Bug 1268403 for CVE-2026-53492",
"url": "https://bugzilla.suse.com/1268403"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.s390x",
"openSUSE Leap 16.0:trivy-0:0.71.2-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-26T09:25:10Z",
"details": "important"
}
],
"title": "CVE-2026-53492"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…