github.com/anchore/syft (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/anchore/syft, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2023-24827 — CVSS 6.5 (medium): syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password…
• CVE-2026-33481 — CVSS 5.3 (medium): Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions…