Aquasec Trivy — known CVE vulnerabilities

Every CVE whose affected-product data names Aquasec Trivy, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2026-33634 — CVSS 8.8 (high) — actively exploited: Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release…
• CVE-2026-55092 — CVSS 7.5 (high): Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation…
• CVE-2026-54448 — CVSS 6.5 (medium): Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with…