CVE-2026-33634 Aquasecurity Setup-Trivy
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags…
- CVSS
- 9.4 Critical
- EPSS
- 60%
- Percentile
- 99
- Published
- 2026-03-23
- Force
- 10 of 12
- Public PoC
- 5
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
On CISA’s exploited list
Aquasecurity Trivy Embedded Malicious Code Vulnerability
- Added
- 2026-03-26
- Federal patch deadline
- 2026-04-09
- Ransomware use
- not known