By vendor

Aquasec vulnerabilities

Known CVEs affecting Aquasec products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-55092HIGH 7.5

  Trivy, a popular container security scanner, has a path traversal vulnerability in versions before 0.71.1. When Trivy downloads container images (OCI artifacts), it reads a label called 'org.opencontainers.image.title' from the image metadata and uses it as a filename without checking whether that filename could escape the intended directory. An attacker who controls a container image can craft this label to include path traversal sequences (like '../'), tricking Trivy into writing downloaded content to arbitrary locations on the host system. This could allow an attacker to overwrite critical files or place malicious content where it will be executed.

• CVE-2026-54448MEDIUM 6.5

  Trivy, a widely-used container and artifact security scanner, contains a denial-of-service vulnerability in its Helm chart processing logic. When Trivy scans a malicious Helm chart archive (.tgz file), it decompresses the contents without enforcing memory limits, allowing an attacker to craft a small file that expands to gigabytes in memory. This causes the Trivy process to consume excessive RAM and be killed by the operating system, disrupting security scanning operations. The vulnerability affects versions prior to 0.71.0 and requires the attacker to have the ability to place a malicious .tgz file where Trivy will scan it.