Skip to content

Security scan: 10 of 57 tools have vulnerabilities - 2026-08-16 #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Security scan: 10 of 57 tools have vulnerabilities - 2026-08-16 #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3,907 changes: 3,907 additions & 0 deletions bfx/hic-pro/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

2,713 changes: 2,713 additions & 0 deletions bfx/hicexplorer/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 16 additions & 0 deletions bfx/hmmer/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "hmmer",
"scan_timestamp": "2026-08-16T17:06:50Z",
"workflow_run_id": "31960542324",
"versions": {
"3.4": {
"image": "ghcr.io/bundlecore/products/bfx/hmmer:3.4",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
16 changes: 16 additions & 0 deletions bfx/homer2/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "homer2",
"scan_timestamp": "2026-08-16T17:06:54Z",
"workflow_run_id": "31960542324",
"versions": {
"5.1": {
"image": "ghcr.io/bundlecore/products/bfx/homer2:5.1",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
936 changes: 936 additions & 0 deletions bfx/homopolish/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 16 additions & 0 deletions bfx/htslib/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "htslib",
"scan_timestamp": "2026-08-16T17:07:13Z",
"workflow_run_id": "31960542324",
"versions": {
"1.24": {
"image": "ghcr.io/bundlecore/products/bfx/htslib:1.24",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
16 changes: 16 additions & 0 deletions bfx/htstream/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "htstream",
"scan_timestamp": "2026-08-16T17:07:17Z",
"workflow_run_id": "31960542324",
"versions": {
"1.4.1": {
"image": "ghcr.io/bundlecore/products/bfx/htstream:1.4.1",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
17,766 changes: 17,766 additions & 0 deletions bfx/humann/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

769 changes: 769 additions & 0 deletions bfx/igv/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 16 additions & 0 deletions bfx/impute2/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "impute2",
"scan_timestamp": "2026-08-16T17:08:11Z",
"workflow_run_id": "31960542324",
"versions": {
"2.3.2": {
"image": "ghcr.io/bundlecore/products/bfx/impute2:2.3.2",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
2,010 changes: 2,010 additions & 0 deletions bfx/instrain/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

29,692 changes: 29,692 additions & 0 deletions bfx/interproscan/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

2,729 changes: 2,729 additions & 0 deletions bfx/ipyrad/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

830 changes: 830 additions & 0 deletions bfx/ismapper/trivy-scan-results.json
View file
Open in desktop

Large diffs are not rendered by default.

153 changes: 153 additions & 0 deletions bfx/isoquant/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,153 @@
{
"tool": "isoquant",
"scan_timestamp": "2026-08-16T17:09:16Z",
"workflow_run_id": "31960542324",
"versions": {
"4.0.0": {
"image": "ghcr.io/bundlecore/products/bfx/isoquant:4.0.0",
"vulnerabilities": [
{
"VulnerabilityID": "GHSA-6v7p-g79w-8964",
"PkgID": "msgpack@1.1.2",
"PkgName": "msgpack",
"PkgIdentifier": {
"PURL": "pkg:pypi/msgpack@1.1.2",
"UID": "33820b693fb1213e",
"BOMRef": "pkg:pypi/msgpack@1.1.2"
},
"InstalledVersion": "1.1.2",
"FixedVersion": "1.2.1",
"Status": "fixed",
"Layer": {
"Digest": "sha256:f4216eb47f4f923f632ade69c3fed39e9b266f97f4cfc757583fdb448df5b9c8",
"DiffID": "sha256:1a882f85bfcff5f7d3474bb4cd33b636ab77062b8d714b0e8360d3ce3303ee79"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://github.com/advisories/GHSA-6v7p-g79w-8964",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Fingerprint": "sha256:7514a54d912b61de85e2de03f876cd2d5e20106ee389b8ca5abec0d6d5eccae3",
"Title": "MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error",
"Description": "### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.\n\nTherefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.",
"Severity": "HIGH",
"VendorSeverity": {
"ghsa": 3
},
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://github.com/msgpack/msgpack-python",
"https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d",
"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1",
"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964"
],
"PublishedDate": "2026-06-19T21:42:55Z",
"LastModifiedDate": "2026-06-19T21:42:55Z"
},
{
"VulnerabilityID": "CVE-2025-47273",
"VendorIDs": [
"GHSA-5rjg-fvgr-3xxf"
],
"PkgID": "setuptools@70.3.0",
"PkgName": "setuptools",
"PkgIdentifier": {
"PURL": "pkg:pypi/setuptools@70.3.0",
"UID": "ed58bcdeda2bae2f",
"BOMRef": "pkg:pypi/setuptools@70.3.0"
},
"InstalledVersion": "70.3.0",
"FixedVersion": "78.1.1",
"Status": "fixed",
"Layer": {
"Digest": "sha256:f4216eb47f4f923f632ade69c3fed39e9b266f97f4cfc757583fdb448df5b9c8",
"DiffID": "sha256:1a882f85bfcff5f7d3474bb4cd33b636ab77062b8d714b0e8360d3ce3303ee79"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-47273",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Fingerprint": "sha256:d290066a95c769764ed40219813c79401347fabd6a78ca3125587eb7c7802600",
"Title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex",
"Description": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue.",
"Severity": "HIGH",
"CweIDs": [
"CWE-22"
],
"VendorSeverity": {
"alma": 2,
"amazon": 3,
"azure": 3,
"bitnami": 3,
"ghsa": 3,
"nvd": 3,
"oracle-oval": 2,
"photon": 3,
"redhat": 2,
"rocky": 2,
"ubuntu": 2
},
"CVSS": {
"bitnami": {
"V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"V40Score": 7.7
},
"ghsa": {
"V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"V40Score": 7.7
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"V3Score": 8.8
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"V3Score": 7.1
}
},
"References": [
"https://access.redhat.com/errata/RHSA-2025:10407",
"https://access.redhat.com/errata/RHSA-2025:13578",
"https://access.redhat.com/security/cve/CVE-2025-47273",
"https://bugzilla.redhat.com/2366982",
"https://bugzilla.redhat.com/show_bug.cgi?id=2366982",
"https://creativecommons.org/licenses/by/4.0/",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47273",
"https://errata.almalinux.org/9/ALSA-2025-13578.html",
"https://errata.rockylinux.org/RLSA-2025:10407",
"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml",
"https://github.com/pypa/setuptools",
"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88",
"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b",
"https://github.com/pypa/setuptools/issues/4946",
"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf",
"https://linux.oracle.com/cve/CVE-2025-47273.html",
"https://linux.oracle.com/errata/ELSA-2025-9940.html",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-47273",
"https://ubuntu.com/security/notices/USN-7544-1",
"https://ubuntu.com/security/notices/USN-8010-1",
"https://www.cve.org/CVERecord?id=CVE-2025-47273"
],
"PublishedDate": "2025-05-17T16:15:19.11Z",
"LastModifiedDate": "2026-06-17T09:27:38.827Z"
}
],
"vulnerability_count": 2
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 2
}
}
16 changes: 16 additions & 0 deletions bfx/ivar/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "ivar",
"scan_timestamp": "2026-08-16T17:09:32Z",
"workflow_run_id": "31960542324",
"versions": {
"1.4.4": {
"image": "ghcr.io/bundlecore/products/bfx/ivar:1.4.4",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
16 changes: 16 additions & 0 deletions bfx/kaiju/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"tool": "kaiju",
"scan_timestamp": "2026-08-16T17:09:35Z",
"workflow_run_id": "31960542324",
"versions": {
"1.10.2": {
"image": "ghcr.io/bundlecore/products/bfx/kaiju:1.10.2",
"vulnerabilities": [],
"vulnerability_count": 0
}
},
"summary": {
"total_versions_scanned": 1,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kentutils/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kentutils",
"scan_timestamp": "2026-08-16T17:09:41Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/khmer/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "khmer",
"scan_timestamp": "2026-08-16T17:09:42Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kissplice/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kissplice",
"scan_timestamp": "2026-08-16T17:09:43Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kma/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kma",
"scan_timestamp": "2026-08-16T17:09:43Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kmc/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kmc",
"scan_timestamp": "2026-08-16T17:09:44Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kmer-jellyfish/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kmer-jellyfish",
"scan_timestamp": "2026-08-16T17:09:45Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kmergenie/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kmergenie",
"scan_timestamp": "2026-08-16T17:09:46Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kneaddata/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kneaddata",
"scan_timestamp": "2026-08-16T17:09:47Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/kover/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "kover",
"scan_timestamp": "2026-08-16T17:09:48Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/krakentools/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "krakentools",
"scan_timestamp": "2026-08-16T17:09:49Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
10 changes: 10 additions & 0 deletions bfx/lambda/trivy-scan-results.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"tool": "lambda",
"scan_timestamp": "2026-08-16T17:09:50Z",
"workflow_run_id": "31960542324",
"versions": {},
"summary": {
"total_versions_scanned": 0,
"total_vulnerabilities": 0
}
}
Loading