CISA Adds Critical Aquasecurity Trivy Scanner Vulnerability to KEV Catalog

**Executive Summary:** CISA added CVE-2026-33634 — a malicious-code vulnerability (CWE-506) in the Trivy scanner used in CI/CD pipelines — to its Known Exploited Vulnerabilities catalog; successful exploitation can give attackers full visibility into CI/CD environments and allow theft of development tokens, SSH keys, cloud credentials, and database passwords, prompting an FCEB remediation deadline and guidance to cease Trivy use until mitigated.