Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33634US | high8.8OT kritisch | KEV | ||
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquas… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.litellm.ai/blog/security-update-march-2026WEB
- https://futuresearch.ai/blog/litellm-pypi-supply-chain-attackWEB
- https://github.com/BerriAI/litellm/issues/24518WEB
- https://github.com/BerriAI/litellm/issues/24518#issuecomment-4127436387WEB
- https://github.com/aquasecurity/trivy/discussions/10425WEB
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23ADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yamlWEB
- https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jcWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan