GO-2026-4919: Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
GO-2026-5983: Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy
GO-2026-6250: Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy
GO-2026-6294: Path traversal via crafted vulnerability database or other downloaded artifacts in github.com/aquasecurity/trivy