Aquasec Trivy Action — known CVE vulnerabilities

Every CVE whose affected-product data names Aquasec Trivy Action, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2026-33634 — CVSS 8.8 (high) — actively exploited: Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release…
• CVE-2026-26189 — CVSS 5.9 (medium): Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in…