Actively exploited vulnerabilities affecting Aquasecurity products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-33634https://wildfortech.com/security#CVE-2026-33634Trivy, a widely used open-source vulnerability scanner commonly embedded in CI/CD pipelines, has been found to contain malicious code. Because Trivy runs with access to pipeline environments, an attacker exploiting this could harvest every secret the pipeline touches — OAuth tokens, SSH keys, cloud provider credentials, database passwords, and sensitive in-memory configuration. Any organization using Trivy in automated build or deployment workflows should treat this as a high-priority supply chain compromise.Thu, 26 Mar 2026 00:00:00 GMTAquasecurityTrivy