CVE-2026-33634 CISA KEV · Actively exploited
Aquasecurity Trivy Embedded Malicious Code Vulnerability
CVSS score
—
EPSS probability
%1.7
Risk score
—
Published
6 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
Similar Vulnerabilities
6.8
CVE-2026-63328Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-33634"