What’s Vulnerable › Products

aquasecurity trivy vulnerabilities

6 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your aquasecurity trivy version is affected

Exploited aquasecurity trivy vulnerabilities

• CVE-2026-33634 — Aquasecurity Trivy Embedded Malicious Code Vulnerability

Latest aquasecurity trivy vulnerabilities

• CVE-2026-104994 — (CVSS 2.5)
• CVE-2026-63328 — Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write (CVSS 6.8)
• CVE-2026-55092 — Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts (CVSS 7.5)
• CVE-2026-54448 — Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser (CVSS 6.5)
• CVE-2026-33634 — Aquasecurity Trivy Embedded Malicious Code Vulnerability (CVSS 8.8) — exploited
• CVE-2024-35192 — Trivy possibly leaks registry credential when scanning images from malicious registries (CVSS 5.5)