HIGHCVSS 8.8Actively exploited · CISA KEV since 2026-03-26Vulnerability
CVE-2026-33634
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.
Properties
- Vulnerability name
- Aquasecurity Trivy Embedded Malicious Code Vulnerability
- Epss score
- 0.01748
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-04-09
- Exploited euvd since
- 2026-03-26T00:00:00+00:00
- Date added
- 2026-03-26
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Ghsa updated
- 2026-03-30T20:51:04Z
- Score
- 8.8
- Euvd base score version
- 4.0
- Euvd vendor
- team-telnyx, berriai, aquasecurity
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.4
- Is ghsa only
- false
- Vendor project
- Aquasecurity
- Content hash
- 3080f52664de3fd2f6f9a5e27d4c23a9aa45469d9180149225f1373a4c1071d6
- Published at
- 2026-03-23T22:16:31.290
- Euvd updated
- 2026-03-30T14:40:28+00:00
- Last modified
- 2026-06-17T10:37:49.183
- Euvd epss pct
- 1.68
Related Entities (14)
AFFECTS_PRODUCT (7)
AFFECTS (3)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph