Skip to content
OpenAdvisories

Vendor

Aqua Security

7 known vulnerabilities.

Products

trivy 5 trivy-action 2 trivy-vscode-extension 1 setup-trivy 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 62%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI Aqua Security team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 10.0
    CVE-2026-28353

    Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

    Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent…

    Aqua Security trivy-vscode-extension