Skip to content
Aquasecurity Trivy vulnerabilities
-
aquasec trivy
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to...
CVE-2026-104994
2.5 Low
-
aquasecurity trivy
Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
CVE-2026-63328
Fix available
6.8 Medium
-
aquasec trivy
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
CVE-2026-54448
Fix available
6.9 Medium
-
aquasec trivy
Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts
CVE-2026-55092
Fix available
7.0 High
-
aquasec setup-trivy, trivy, aquasecurity trivy-action +3 more +5 more
Trivy ecosystem supply chain briefly compromised
CVE-2026-33634
In KEVPublic exploitFix available
EPSS 60.4%
9.4 Critical
-
aquasecurity trivy-vscode-extension
Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release
CVE-2026-28353
10.0 Critical
-
aquasec trivy action, aquasecurity trivy-action +1 more
Trivy Action has a script injection via sourced env file in composite action
CVE-2026-26189
Public exploitFix available
5.9 Medium
-
aquasecurity trivy
Trivy possibly leaks registry credential when scanning images from malicious registries
CVE-2024-35192
Fix available
5.5 Medium