AQ
Vendor
aquasec
7
CVEs
3
On KEV
1
New 30D
Products
TR8.8
Trivy
aquasec
4 CVEs1 on KEV1 new
TA8.8
Trivy Action
Aquasec
2 CVEs1 on KEV0 new
SE8.8
Setup-trivy
Aquasec
1 CVEs1 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104994 | TR Trivy aquasec | 2.5 | Oct 2 | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root |
| CVE-2026-54448 | TR Trivy Aquasec | 6.5 | Jun 25 | Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser |
| CVE-2026-55092 | TR Trivy Aquasec | 7.5 | Jun 25 | Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts |
| CVE-2026-33634 In wildKEV | TR Trivy Aquasec | 8.8 | Mar 23 | Trivy ecosystem supply chain briefly compromised |
| CVE-2026-26189 | TA Trivy Action Aquasec | 8.1 | Feb 19 | Trivy Action has a script injection via sourced env file in composite action |