Skip to content
Threat Feed
Subscribe

Vendor

Aqua Security

3 briefs RSS
high advisory

Path Traversal in Trivy via OCI Artifact Annotation

Trivy versions prior to 0.71.1 are vulnerable to arbitrary file write via path traversal in OCI artifact titles, allowing attackers to overwrite files if a user is directed to an untrusted OCI registry.

Trivy
2t 1c
high advisory

Autonomous AI Agents Pose New Supply Chain and Data Exfiltration Risks

This content introduces AI Detection and Response (AIDR) as a new cybersecurity category to address emerging threats from autonomous AI agents, including supply chain attacks and unintended data sharing, highlighting their ability to execute with inherited privileges across endpoints, SaaS, and cloud environments.

ClawHub +42 ai agentic-ai aidr supply-chain-attack data-exfiltration cloud-security endpoint-security saas-security
4t 16i updated
high threat

Vect and TeamPCP Partner for Ransomware Campaigns Exploiting Supply Chain Compromises

The threat groups Vect and TeamPCP have formally partnered since March 2026 to conduct widespread ransomware deployment and extortion campaigns by leveraging TeamPCP's credential harvesting and data theft capabilities, often initiated through supply chain compromises involving poisoned software updates and exploitation of critical vulnerabilities like CVE-2025-55182, leading to significant data exfiltration and encrypted systems across multiple sectors.

React Server Components +10 Vect +1 ransomware supply-chain-attack data-theft credential-access extortion python github pypi
1r 10t 1i updated