Grype has a credential disclosure vulnerability in Grype JSON output

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-65965 · Microsoft / collected KEV context

EUVD-2025-199596

GHSA-6gxw-85q2-q646

GO-2025-4160

cve-program · CVE-2025-65965

• https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646
• https://github.com/anchore/grype/pull/3068
• https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1

euvd · EUVD-2025-199596

• https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646
• https://github.com/anchore/grype/pull/3068
• https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1

nvd · CVE-2025-65965

• https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1
• https://github.com/anchore/grype/pull/3068
• https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646

osv · GHSA-6gxw-85q2-q646

• https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646
• https://nvd.nist.gov/vuln/detail/CVE-2025-65965
• https://github.com/anchore/grype/pull/3068
• https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1
• https://github.com/anchore/grype/commit/c99f79de49a58dc16d7fd8f35160b169b87db9de
• https://github.com/anchore/grype

osv · GO-2025-4160

• https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646
• https://github.com/anchore/grype/commit/c99f79de49a58dc16d7fd8f35160b169b87db9de
• https://github.com/anchore/grype/pull/3068

No related operational record is retained in the current change model.