# Trivy ignore file for Reversecore_MCP
# Ignore false positives in external dependencies and third-party tools.

# pip vulnerability (MEDIUM/LOW) - pip is in the build virtualenv
CVE-2025-8869
CVE-2026-3219
CVE-2026-6357
CVE-2026-1703
# pip._vendor internal vendored copies (runtime environment uses patched msgpack>=1.2.1 and setuptools>=83.0.0)
GHSA-6v7p-g79w-8964
CVE-2026-57585
CVE-2025-47273
CVE-2026-59890


# Temporary Pillow exceptions for the Qiling emulation dependency chain.
# qiling==1.4.6 -> python-fx==0.4.0 requires Pillow<11, while these fixes
# require Pillow>=12.1.1/12.2.0. Migration/isolation is tracked in issue #146.
# These exceptions expire automatically and must not be renewed without review.
CVE-2026-25990 exp:2026-10-15
CVE-2026-40192 exp:2026-10-15
CVE-2026-42308 exp:2026-10-15
CVE-2026-42310 exp:2026-10-15
CVE-2026-42311 exp:2026-10-15

# False positive secrets in third-party libraries (hcli / ida-hcli)
jwt-token

# liblzma5 / xz-utils DoS vulnerability in debian base image (CVE-2026-34743)
CVE-2026-34743 exp:2026-10-15

# libssh2-1 vulnerabilities in debian base image (CVE-2026-58050, CVE-2026-7598, CVE-2025-15661, CVE-2026-58051, CVE-2026-66032, CVE-2026-66034)
# Debian security update 1.10.0-3+deb12u1 released; added --only-upgrade libssh2-1 to Dockerfile.
CVE-2026-58050 exp:2026-10-15
CVE-2026-7598 exp:2026-10-15
CVE-2025-15661 exp:2026-10-15
CVE-2026-58051 exp:2026-10-15
CVE-2026-66032 exp:2026-10-15
CVE-2026-66034 exp:2026-10-15
