Skip to content
OpenAdvisories

Vendor

Aqua Security

7 known vulnerabilities.

Aqua Security at a glance

Last 12 months
6
Critical · all time
2
Exploited · all time
1
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 2 vulnerabilities, 2 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202622
Feb 202610
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

trivy 5 trivy-action 2 trivy-vscode-extension 1 setup-trivy 1

Latest advisories

  • Medium max 6.8
    WID-SEC-2026-2148 1 CVE rev. 2

    Aqua Security Trivy: Schwachstelle ermöglicht Manipulation von Dateien

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Aqua Security Trivy ausnutzen, um Dateien zu manipulieren.

    Aqua Security Linux
    first Jun 30, 2026
  • Medium max 6.9
    WID-SEC-2026-2082 1 CVE rev. 5

    Aqua Security Trivy: Schwachstelle ermöglicht Denial of Service

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Aqua Security Trivy ausnutzen, um einen Denial of Service Angriff durchzuführen.

    SUSE Aqua Security Linux
    first Jun 25, 2026
  • High max 7.0
    WID-SEC-2026-1924 1 CVE rev. 5

    Aqua Security Trivy: Schwachstelle ermöglicht Manipulation von Dateien

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Aqua Security Trivy ausnutzen, um Dateien zu manipulieren.

    SUSE Aqua Security Windows
    first Jun 14, 2026
  • Critical max 9.4
    WID-SEC-2026-0898 1 CVE 1 exploited

    Aqua Security Trivy: Schwachstelle ermöglicht vollständige Kompromittierung des Systems

    Ein Angreifer kann eine Schwachstelle in Aqua Security Trivy ausnutzen, um das vollständige System zu kompromittieren.

    Aqua Security Linux Windows macOS
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 6.8
    CVE-2026-63328

    Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

    Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malici…

    Aqua Security trivy kubescape github.com/aquasecurity/trivy Wolfi Go
  • Medium 6.9
    CVE-2026-54448

    Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

    Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small c…

    Aqua Security trivy trivy-operator github.com/aquasecurity/trivy Wolfi Go
  • High 7.0
    CVE-2026-55092

    Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

    Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attack…

    Aqua Security trivy kubescape github.com/aquasecurity/trivy Wolfi Go
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI Aqua Security team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 10.0
    CVE-2026-28353

    Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

    Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent…

    Aqua Security trivy-vscode-extension
  • Medium 5.9
    CVE-2026-26189 Public exploit

    Trivy Action has a script injection via sourced env file in composite action

    Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting envi…

    Aqua Security trivy-action aquasecurity/trivy-action GitHub Actions
  • Medium 5.5
    CVE-2024-35192

    Trivy possibly leaks registry credential when scanning images from malicious registries

    Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Regis…

    Aqua Security trivy zot kubescape Wolfi Go