Threats affecting pkg:rpm/suse/trivy

This update for trivy fixes the following issues: - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111). - CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624). - CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and denial of service (bsc#1278624). - CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection deadlocks and denial of service (bsc#1278624).

This security update for the Trivy tool addresses multiple vulnerabilities across several dependencies, including improper certificate validation, HTTP method override bypass, denial of service via oversized inputs, information disclosure through crafted tarball hardlinks, authentication bypass and deadlocks in SSH libraries, authorization bypass due to header case mismatches, heap memory exhaustion, and denial of service from missing headers in gRPC servers. These issues collectively pose risks ranging from low to potentially higher impact depending on context. The update fixes these issues to improve overall security.