Update: Ongoing Investigation and Continued Remediation

Aqua Trivy Blog

Update: Ongoing Investigation and Continued Remediation

Open Source Security Advisory Update: Wednesday, April 1, 2026 Boston, MA 10:00 AM ET Over the past week, we have nearly finalized our investigation and are now in the final stages of documentation and review. There continues to be no indication that Aqua’s commercial products have been affected. As part of this process, we identified …

More on Trivy

Aqua at KubeCon 2025: Securing Cloud Native and AI Apps

Aqua at KubeCon 2025: Securing Cloud Native and AI Apps thumbnail

Security That Speaks Your Language: Trivy MCP Server

Security That Speaks Your Language: Trivy MCP Server thumbnail

Dev-First Security: Aqua Trivy Scanning Now in VS Code

Dev-First Security: Aqua Trivy Scanning Now in VS Code thumbnail

Trivy Partners with echo: Slashing CVEs at the Source

Trivy Partners with echo: Slashing CVEs at the Source thumbnail

Trivy VEX Hub:The Solution to Vulnerability Fatigue

Trivy VEX Hub:The Solution to Vulnerability Fatigue thumbnail

Security That Speaks Your Language: Trivy MCP Server

What if checking your project for vulnerabilities was as simple as asking a question? Or if your coding AI agent could automatically run a scan every time you changed a Dockerfile? The new Trivy MCP Server makes all that possible, and more.

Dev-First Security: Aqua Trivy Scanning Now in VS Code

In modern development workflows, integrating security seamlessly into the development process is crucial for delivering secure applications efficiently. Developers need security tools that work naturally within their development environment, providing immediate feedback without disrupting their workflow. The new Trivy extension for Visual Studio Code addresses this need by directly bringing comprehensive security scanning capabilities into …

Trivy Partners with echo: Slashing CVEs at the Source

This is a guest post by Echo Imagine starting every project with CVE-free base images, without adding any extra effort or tooling to your workflow. As developers and security teams, we know how hard it is to shift left when the base you’re building on is already vulnerable. That’s why we’re excited to be a …

5 Must-See Sessions at KubeCon North America

Who’s getting excited? Next week, the Cloud Native Computing Foundation’s flagship conference, KubeCon + CloudNativeCon, will kick off in Salt Lake City, Utah. In its ninth year, the conference has grown into more than just a technical conference—it’s a vibrant community event that offers attendees the tools, relationships, and inspiration to drive innovation in the …

Trivy VEX Hub:The Solution to Vulnerability Fatigue

VEX (Vulnerability eXploitability Exchange) is an emerging industry standard for communicating the relevance and impact of security vulnerabilities on software artifacts. This approach allows software maintainers to indicate when a specific vulnerability in a software dependency is irrelevant to their software due to the specific use case of that dependency. By conveying this crucial information …

Scanning KBOM for Vulnerabilities with Trivy

Early this summer we announced the release of Kubernetes Bills of Material (KBOM) as part of Trivy, our all in one, popular open source security scanner. In the blog we discussed how KBOM is the manifest of all the important components that make up your Kubernetes cluster: Control plane components, Node Components, and Addons, including …

New in Trivy: Kubernetes CIS Benchmark Scanning

CIS (Center for Internet Security) compliance scanning is a standard in Kubernetes (K8s) security and is widely adopted across the industry with implementations in several security scanners. Kube-bench, an open source project developed by Aqua Security was one of the first projects to provide Kubernetes CIS compliance scanning and became a staple in K8s security. …

Kubernetes Benchmark Scans with Trivy: CIS and NSA Reports

One of Trivy’s core features is Trivy Kubernetes for in-cluster security scans of running workloads. This tutorial will showcase how to generate CIS and NSA reports both through the Trivy CLI and the Trivy Operator. Additionally, we will look at how users can add the Kubernetes Specification for their own Compliance Report format to expand …

Trivy Now Scans Amazon Machine Images (AMIs)

While more and more companies are moving to a cloud native technologies to manage their workloads and infrastructure, Virtual Machines (VMs) remain a staple infrastructure that powers many existing organizations and applications. Trivy, the all-in-one open-source security scanner, already scans most of the cloud native stack including containers, clusters, and clouds. Today, we are announcing …

Trivy Can Now Scan Unpackaged Binary Files

Trivy, the all-in-one security scanner, is now able to scan binary files in your scan targets such as container images. Most security scanners rely on package managers to discover vulnerabilities. Trivy now uses Rekor from Sigstore to look up the hash of a binary file. If a relevant SBOM is found through the hash, Trivy …

Vulnerability Scanning: Trivy vs the Trivy Operator

Over the past few months Aqua Trivy, the all-in-one cloud native security scanner, has rapidly grown in features and tapped into new use cases. In this blog post, we will explore

Page 1 of 512 3 4 5 Next ›

Need to secure enterprise workloads?

Aqua Cloud Native Application Protection Platform (CNAPP)

Go cloud native with the experts!

Get Demo

Aqua Security is the pioneer in securing containerized cloud native applications from development to production. Aqua's full lifecycle solution prevents attacks by enforcing pre-deployment hygiene and mitigates attacks in real time in production, reducing mean time to repair and overall business risk. The Aqua Platform, a Cloud Native Application Protection Platform (CNAPP), integrates security from Code to Cloud, combining the power of agent and agentless technology into a single solution. With enterprise scale that doesn’t slow development pipelines, Aqua secures your future in the cloud. Founded in 2015, Aqua is headquartered in Boston, MA and Ramat Gan, IL protecting over 500 of the world’s largest enterprises.

Read Aqua Security reviews on G2

Use Cases

Environments

Partners

Products

Get Started

Copyright © 2026 Aqua Security Software Ltd. Privacy Policy | Terms of Use | Cookie Policy | |