Vendor
Aquasecurity
7 known vulnerabilities in products by Aquasecurity, 1 of them actively exploited (CISA KEV).
Key figures
7
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-33634 | Trivy ecosystem supply chain briefly compromised In CISA KEValso in 4 other products | 8.8 | |
| High | CVE-2026-26189 | Trivy Action has a script injection via sourced env file in composite action | 5.9 | |
| Critical | CVE-2026-28353 | Aquasecurity Trivy-vscode-extension: Embedded Malicious Code | — | |
| High | CVE-2026-55092 | Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts | 7.5 | |
| Medium | CVE-2026-54448 | Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser | 6.5 | |
| Medium | CVE-2026-63328 | Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write | — | |
| Medium | CVE-2024-35192 | Trivy possibly leaks registry credential when scanning images from malicious registries | 5.5 |
Products
| Trivy | 5 | 1 |