CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-03-23
Aqua Security Trivy Supply Chain Attack and Malicious Release (CVE-2026-33634) Critical Security Advisory
[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6
[Impact] A threat actor used compromised credentials to force-push malicious commits to version tags, enabling credential exfiltration from CI/CD pipelines
[Mitigation] Upgrade to safe versions (Trivy v0.69.2/v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6 recreated) and pin actions to immutable commit SHAs