diff --git a/.grype.yaml b/.grype.yaml
index 8df51fce88..18345342e8 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -7,119 +7,6 @@
 
 ignore:
 
-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
-  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
-  # endpoint exists in the image. Pinned to the embedded version so the rule stops
-  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
-  # https://github.com/aquasecurity/trivy/pull/11176
-  - vulnerability: CVE-2026-84304
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
-  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
-  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
-  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
-  # with the Trivy exception by 2026-10-15.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - vulnerability: CVE-2026-84445
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
-  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
-  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
-  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
-  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
-  - vulnerability: CVE-2026-56855
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-78662
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  # Go 1.27.1 and golang.org/x/net v0.59.0 in Trivy 0.75.0, the latest release. Fixed in
-  # Go 1.27.2 and x/net 0.60.0, which only Trivy main has. Almost every entry is an HTTP,
-  # HTTP/2 or TLS server path (or Windows-only), and Trivy runs here only as a client. The
-  # two client-side ones are a DoS from a hostile HTTP/2 peer (CVE-2026-78669) and an
-  # unframed CONNECT body sent through a proxy (CVE-2026-56866); Trivy's only peer is the
-  # TLS-authenticated database registry and it never sends CONNECT with a body. Pinned to
-  # the embedded versions. Remove with the Trivy exception by 2026-11-15.
-  - vulnerability: CVE-2026-56857
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-56866
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-78659
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-78660
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-78663
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-78669
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-94439
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-94440
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-97031
-    package:
-      name: stdlib
-      version: go1.27.1
-  - vulnerability: CVE-2026-78659
-    package:
-      name: golang.org/x/net
-      version: v0.59.0
-  - vulnerability: CVE-2026-78660
-    package:
-      name: golang.org/x/net
-      version: v0.59.0
-  - vulnerability: CVE-2026-78663
-    package:
-      name: golang.org/x/net
-      version: v0.59.0
-  - vulnerability: CVE-2026-78669
-    package:
-      name: golang.org/x/net
-      version: v0.59.0
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
   # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
   # Not a dependency we declare, and not one we can upgrade independently.
   - vulnerability: CVE-2026-26127
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index 058071207a..c13bd5f114 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -198,40 +198,6 @@ vulnerabilities:
       - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
     expired_at: 2027-01-31
 
-  # CVE-2026-78667 and CVE-2026-97031 are DoS bugs in the Go standard library: net/http
-  # burns CPU parsing a Range header with a large number of small ranges in FileServer,
-  # ServeContent and ServeFile, and crypto/tls lets a client exhaust server memory with
-  # multiple ECH outer extension references. Both are server-side code paths. Fixed in
-  # Go 1.26.9 and 1.27.2 (released 2026-10-08). Trivy 0.75.0, the latest published
-  # release and the version the images ship, is built with go1.27.1, and Trivy main
-  # still declares `go 1.27.0`:
-  # https://github.com/aquasecurity/trivy/blob/v0.75.0/go.mod
-  # Prowler invokes Trivy exclusively as `trivy fs` and `trivy image` on a local path,
-  # never `trivy server`, so no HTTP or TLS listener ever exists in the image; its only
-  # TLS use is as a client pulling the vulnerability database. The purl is pinned to the
-  # stdlib version so the entry retires itself on the next Trivy bump. Remove this
-  # temporary suppression as soon as a Trivy release is built with Go >= 1.27.2.
-  - id: CVE-2026-78667
-    purls:
-      - "pkg:golang/stdlib@v1.27.1"
-    expired_at: 2026-11-15
-  - id: CVE-2026-97031
-    purls:
-      - "pkg:golang/stdlib@v1.27.1"
-    expired_at: 2026-11-15
-
-  # CVE-2026-78669 is an HTTP/2 DoS in the same Trivy 0.75.0 binary (stdlib 1.27.1 and
-  # golang.org/x/net 0.59.0): a malicious peer burns CPU with many small SETTINGS frames.
-  # Unlike the two above it also hits clients, but Trivy's only HTTP/2 peer here is the
-  # TLS-authenticated registry serving the vulnerability database, and the worst case is
-  # a slow scan. Fixed in Go 1.27.2 and x/net 0.60.0, which Trivy main already pulls in
-  # but no release ships yet. Same retirement rule as above.
-  - id: CVE-2026-78669
-    purls:
-      - "pkg:golang/stdlib@v1.27.1"
-      - "pkg:golang/golang.org/x/net@v0.59.0"
-    expired_at: 2026-11-15
-
   # Unlike the manifest entries above, this DLL ships in the image:
   # ExchangeOnlineManagement/3.10.1/netCore/System.Security.Cryptography.Pkcs.dll. It is a
   # DoS in CMS/PKCS parsing; Prowler only feeds it the tenant's own certificate. 3.10.1 is
@@ -241,20 +207,3 @@ vulnerabilities:
     purls:
       - "pkg:nuget/System.Security.Cryptography.Pkcs@10.0.0"
     expired_at: 2026-12-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
diff --git a/Dockerfile b/Dockerfile
index fd1dcfd706..a9b5237fad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,15 +8,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.75.0
+ARG TRIVY_VERSION=0.76.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f
-ARG TRIVY_SHA256_ARM64=a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3
+ARG TRIVY_SHA256_AMD64=e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7
+ARG TRIVY_SHA256_ARM64=aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c
 ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
 ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
diff --git a/api/Dockerfile b/api/Dockerfile
index af2d08d9de..ab954829f3 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -7,15 +7,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.75.0
+ARG TRIVY_VERSION=0.76.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f
-ARG TRIVY_SHA256_ARM64=a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3
+ARG TRIVY_SHA256_AMD64=e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7
+ARG TRIVY_SHA256_ARM64=aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c
 ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
 ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
diff --git a/api/changelog.d/api-image-trivy-0-76-0.security.md b/api/changelog.d/api-image-trivy-0-76-0.security.md
new file mode 100644
index 0000000000..59473ad497
--- /dev/null
+++ b/api/changelog.d/api-image-trivy-0-76-0.security.md
@@ -0,0 +1 @@
+Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
diff --git a/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md b/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md
new file mode 100644
index 0000000000..99fd4c2c70
--- /dev/null
+++ b/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md
@@ -0,0 +1 @@
+Trivy from 0.75.0 to 0.76.0 in the SDK container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0