Anchore vulnerabilities
We track 6 vulnerabilities in Anchore products across 6 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest Anchore vulnerabilities
- 8.8 High severity
Anchore Enterprise: Incorrect Use of Privileged APIs
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifyi
- 7.3 High severity
Anchore Enterprise: Improper Neutralization of Special Elements used in an SQL Command
Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contai
- 8.2 High severity
grype: Improper Removal of Sensitive Information Before Storage or Transfer
Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file
- 9.8 Critical severity
stereoscope: Improper Limitation of a Pathname to a Restricted Directory
stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outsid
- 7.5 High severity
syft: Insertion of Sensitive Information into Log File
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASS
- 7.5 High severity
Anchore Enterprise: Insufficiently Protected Credentials
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl.