trivy vulnerabilities

2 known vulnerabilities in trivy from Aquasecurity. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  trivy: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-55092Jun 25, 2026Aquasecurity

  Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacke

• 8.8 High severity

  Aquasecurity Trivy Embedded Malicious Code Exploited

  CVE-2026-33634Mar 23, 2026AquasecurityEPSS 61.5%

  Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in