This Red Hat security advisory (RHSA-2026:35111) announces an update to the trivy RPMs included in Red Hat Hardened Images. The update to trivy-0.72.0-0.1.hum1 (for aarch64 and x86_64 architectures) addresses multiple security vulnerabilities identified by CVE-2026-46680, CVE-2026-47262, and CVE-2026-53488. The advisory does not provide CVSS scores or detailed technical descriptions of the vulnerabilities, but the presence of multiple CWEs (CWE-681, CWE-770, CWE-1289, CWE-78) suggests issues related to numeric errors, improper resource shutdown, and command injection. No affected versions are explicitly stated, and no known exploits have been reported. The advisory references Red Hat's update infrastructure for applying the fix.

The vulnerabilities addressed are rated as high severity by Red Hat. Although specific impacts are not detailed, the associated CWEs imply potential risks such as improper numeric handling, resource management flaws, and command injection vulnerabilities, which could lead to unauthorized command execution or system instability if exploited. No active exploitation in the wild has been reported.

A security update is available for the trivy RPMs in Red Hat Hardened Images, specifically version 0.72.0-0.1.hum1. Users should apply this update promptly by following the instructions provided at https://images.redhat.com/. Since this is a vendor-issued update, applying the official patch is the recommended remediation. No alternative mitigations or temporary fixes are indicated in the advisory.