CVE-2026-33634 - Trivy vulnerability

[RobSHK]

Hi all,
A new security vulnerability has been disclosed in Trivy. Does this affect the Trivy analyzer that is part of Dependency Track in any way?

[nscuro]

It doesn't affect Dependency-Track's side of the integration, as it merely calls the API of a Trivy server that users operate. So if you're running Trivy, it's up to you to handle it appropriately.

As for Trivy usage in Dependency-Track's own CI/CD infra, we addressed that here: #5951