TI-2026-26015 CVE-2026-33634 · GHSA-69fq-xp46-6x23
Trivy ecosystem supply chain briefly compromised
Priority CRITICAL 100KEV
Trivy is a security scanner.
Aquasecurity
Records8All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Aquasecurity records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-39311 CVE-2026-54448 · GHSA-q3fv-x8vg-qqm4
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Priority MEDIUM 64
Trivy is a security scanner.
TI-2026-22633 CVE-2026-28353
Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release
Priority MEDIUM 49
Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities.
TI-2026-21180 CVE-2026-26189 · GHSA-9p44-j4g5-cfx5
Trivy Action has a script injection via sourced env file in composite action
Priority MEDIUM 40
Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities.
TI-2026-39796 CVE-2026-55092 · GHSA-mcj4-mphf-j9ff
Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts
Priority LOW 31
Trivy is a security scanner.
TI-2026-45161 CVE-2026-63328 · GHSA-8rc5-4fr6-64pw
Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Priority LOW 29
Trivy is a security scanner.
TI-2024-23265 CVE-2024-35192 · GHSA-xcq4-m2r3-cmrj
Trivy possibly leaks registry credential when scanning images from malicious registries
Priority LOW 24
Trivy is a security scanner.
TI-2026-66156 CVE-2026-104994 · GHSA-fr63-55g9-p68v
Path traversal in Aquasecurity Trivy
Priority LOW 12
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root.