CVE-2026-33634Vulnerability
Aquasecurity Trivy Embedded Malicious Code Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 6 months ago
CISA KEVAdded 26 Mar 2026
Fix due 9 Apr 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 9 Apr 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS1.7%
higher than 77% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 77% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables“CVE involved: CVE-2026-33634.”
Indicators reported together
named in the same reports- context[.]aiin 1 report
- env[.]readin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.