-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.trivyignore
More file actions
125 lines (125 loc) · 4.3 KB
/
Copy path.trivyignore
File metadata and controls
125 lines (125 loc) · 4.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
# Base-image vulnerabilities inherited from ghcr.io/actions/actions-runner.
# These cannot be fixed in this repo; they are tracked here until the upstream
# runner image is updated. See README "Security" and RUNNER_VERSION in manifest.yaml.
# Expiration causes Trivy to re-report after the date so we re-evaluate when
# upgrading the base image (e.g. via Renovate).
#
# Ubuntu (linux-libc-dev / kernel)
CVE-2024-35870 exp:2026-08-19
CVE-2024-53179 exp:2026-08-19
CVE-2025-37849 exp:2026-08-19
CVE-2025-37899 exp:2026-08-19
CVE-2025-38118 exp:2026-08-19
#
# Node (runner externals/node20)
CVE-2024-21538 exp:2026-08-19
CVE-2025-64756 exp:2026-08-19
CVE-2026-26996 exp:2026-08-19
CVE-2026-23745 exp:2026-08-19
CVE-2026-23950 exp:2026-08-19
CVE-2026-24842 exp:2026-08-19
CVE-2026-26960 exp:2026-08-19
# Node.js bundled deps (sigstore, undici in official node dist)
CVE-2026-48815 exp:2026-08-19
CVE-2026-12151 exp:2026-08-19
# npm deps bundled by the pinned node dist (brace-expansion, js-yaml, tar).
# NODE_VERSION is already the latest 24.x; fixes need a new node release.
CVE-2026-13149 exp:2026-08-19
CVE-2026-14257 exp:2026-08-19
CVE-2026-59869 exp:2026-08-19
CVE-2026-59873 exp:2026-08-19
CVE-2026-59874 exp:2026-08-19
#
# .NET (Runner.Plugins / Runner.Sdk deps)
CVE-2024-38095 exp:2026-08-19
# Microsoft.NETCore.App.Runtime 8.0.28 shipped by actions-runner; RUNNER_VERSION
# is already the latest, so clearing these needs an upstream runner rebuild.
CVE-2026-47302 exp:2026-08-19
CVE-2026-50524 exp:2026-08-19
CVE-2026-50528 exp:2026-08-19
CVE-2026-50651 exp:2026-08-19
CVE-2026-57108 exp:2026-08-19
#
# Go binaries (containerd, containerd-shim-runc-v2, docker-buildx – stdlib)
CVE-2025-68121 exp:2026-08-19
CVE-2025-47907 exp:2026-08-19
CVE-2025-58183 exp:2026-08-19
CVE-2025-61726 exp:2026-08-19
CVE-2025-61728 exp:2026-08-19
CVE-2025-61729 exp:2026-08-19
CVE-2025-61730 exp:2026-08-19
#
# Go binaries we install (dive, argo, kargo, pack, yq); upgrade versions to clear
CVE-2023-45288 exp:2026-08-19
CVE-2026-24051 exp:2026-08-19
CVE-2024-24790 exp:2026-08-19
CVE-2024-34156 exp:2026-08-19
CVE-2024-41110 exp:2026-08-19
CVE-2025-22868 exp:2026-08-19
CVE-2025-22869 exp:2026-08-19
CVE-2025-22874 exp:2026-08-19
CVE-2025-29786 exp:2026-08-19
CVE-2025-30204 exp:2026-08-19
CVE-2025-32445 exp:2026-08-19
CVE-2025-52881 exp:2026-08-19
CVE-2025-59530 exp:2026-08-19
CVE-2025-62156 exp:2026-08-19
CVE-2025-62157 exp:2026-08-19
CVE-2025-65637 exp:2026-08-19
CVE-2025-66626 exp:2026-08-19
CVE-2025-68156 exp:2026-08-19
CVE-2026-23960 exp:2026-08-19
CVE-2026-27112 exp:2026-08-19
#
# Remaining Go-related CVEs from current Trivy report (base/runtime binaries).
# These are tracked temporarily until upstream runner/base/toolchain refreshes.
CVE-2026-33186 exp:2026-08-19
CVE-2026-25679 exp:2026-08-19
CVE-2026-32280 exp:2026-08-19
CVE-2026-32282 exp:2026-08-19
CVE-2026-34986 exp:2026-08-19
CVE-2026-39883 exp:2026-08-19
CVE-2026-34040 exp:2026-08-19
CVE-2026-33747 exp:2026-08-19
CVE-2026-33748 exp:2026-08-19
CVE-2025-15558 exp:2026-08-19
CVE-2026-32281 exp:2026-08-19
CVE-2026-32283 exp:2026-08-19
CVE-2026-33810 exp:2026-08-19
CVE-2026-35469 exp:2026-08-19
CVE-2026-29181 exp:2026-08-19
CVE-2026-33811 exp:2026-08-19
CVE-2026-33814 exp:2026-08-19
CVE-2026-39820 exp:2026-08-19
CVE-2026-39823 exp:2026-08-19
CVE-2026-39825 exp:2026-08-19
CVE-2026-39836 exp:2026-08-19
CVE-2026-42499 exp:2026-08-19
CVE-2026-42504 exp:2026-08-19
CVE-2026-44973 exp:2026-08-19
CVE-2026-45022 exp:2026-08-19
CVE-2026-46680 exp:2026-08-19
#
# gRPC-Go xDS RBAC / HTTP2 advisory in grpc bundled by gh, argo, grype and syft.
# Their latest releases still vendor grpc < 1.82.1, and none of these CLIs run an
# xDS server. Drop once upstream rebuilds against the fixed grpc.
GHSA-hrxh-6v49-42gf exp:2026-08-19
#
# Go stdlib / x/crypto / x/net / containerd — base image and pinned CLIs without fixed releases yet.
CVE-2026-25681 exp:2026-08-19
CVE-2026-27136 exp:2026-08-19
CVE-2026-27145 exp:2026-08-19
CVE-2026-39821 exp:2026-08-19
CVE-2026-39822 exp:2026-08-19
CVE-2026-39828 exp:2026-08-19
CVE-2026-39829 exp:2026-08-19
CVE-2026-39830 exp:2026-08-19
CVE-2026-39831 exp:2026-08-19
CVE-2026-39832 exp:2026-08-19
CVE-2026-39835 exp:2026-08-19
CVE-2026-42508 exp:2026-08-19
CVE-2026-46595 exp:2026-08-19
CVE-2026-46597 exp:2026-08-19
CVE-2026-53488 exp:2026-08-19
CVE-2026-53489 exp:2026-08-19
CVE-2026-53492 exp:2026-08-19