ghcr.io/aquasecurity/trivy:0.71.2
Base OS: alpine 3.24.131 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/aquasecurity/trivy:0.71.2
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/aquasecurity/trivy:0.71.2
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/aquasecurity/trivy:0.71.2 \ --owner verity-org
Before patching
Found 46 vulnerabilities in the original image. 31 fixed by Copa. 15 remaining after patching.
20 HIGH19 MEDIUM2 LOW5 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-53488HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.3.1
- Fixed
- 2.0.10, 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53489HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.3.1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53492HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.3.1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-50151HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-47262MEDIUM
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.3.1
- Fixed
- 2.0.10, 2.1.9, 2.2.5, 2.3.2
- CVE-2026-50195MEDIUM
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.3.1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-49834MEDIUM
- Package
- github.com/sigstore/sigstore-go
- Installed
- v1.1.4
- Fixed
- 1.2.0
- CVE-2026-49835MEDIUM
- Package
- github.com/sigstore/timestamp-authority/v2
- Installed
- v2.0.6
- Fixed
- 2.1.0
- CVE-2026-50162MEDIUM
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- GHSA-vh4v-2xq2-g5cgMEDIUM
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-42505MEDIUM
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-48978LOW
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- 2.6.1
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-53488 | github.com/containerd/containerd/v2 | v2.3.1 | 2.0.10, 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-53489 | github.com/containerd/containerd/v2 | v2.3.1 | 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-53492 | github.com/containerd/containerd/v2 | v2.3.1 | 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-50151 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | HIGH |
| CVE-2026-47262 | github.com/containerd/containerd/v2 | v2.3.1 | 2.0.10, 2.1.9, 2.2.5, 2.3.2 | MEDIUM |
| CVE-2026-50195 | github.com/containerd/containerd/v2 | v2.3.1 | 2.1.9, 2.2.5, 2.3.2 | MEDIUM |
| CVE-2026-49834 | github.com/sigstore/sigstore-go | v1.1.4 | 1.2.0 | MEDIUM |
| CVE-2026-49835 | github.com/sigstore/timestamp-authority/v2 | v2.0.6 | 2.1.0 | MEDIUM |
| CVE-2026-50162 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | MEDIUM |
| GHSA-vh4v-2xq2-g5cg | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | MEDIUM |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | MEDIUM |
| CVE-2026-48978 | oras.land/oras-go/v2 | v2.6.0 | 2.6.1 | LOW |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-50163HIGH
- Package
- oras.land/oras-go/v2
- Installed
- v2.6.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.52.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-50163 | oras.land/oras-go/v2 | v2.6.0 | HIGH | |
| GO-2026-5932 | golang.org/x/crypto | v0.52.0 | UNKNOWN |
Original image reference
ghcr.io/aquasecurity/trivy:0.71.2