Aquasecurity

Tracked CVEs

Coverage timeline

• 
  TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)

  isc.sans.edu · Apr 8, 2026
• 
  TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd)

  isc.sans.edu · Apr 3, 2026
• 
  10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions

  www.stepsecurity.io · Mar 30, 2026
• 
  TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released, (Mon, Mar 30th)

  isc.sans.edu · Mar 30, 2026
• 
  TeamPCP Supply Chain Campaign: Update 003 - Operational Tempo Shift as Campaign Enters Monetization Phase With No New Compromises in 48 Hours, (Sat, Mar 28th)

  isc.sans.edu · Mar 28, 2026
• 
  U.S. CISA adds an Aquasecurity Trivy flaw to its Known Exploited Vulnerabilities catalog

  securityaffairs.com · Mar 27, 2026
• 
  CISA Adds CVE-2026-33634 to Known Exploited Vulnerabilities Catalogue

  www.cisa.gov · Mar 26, 2026
• 
  TeamPCP Supply Chain Campaign: Update 001 ? Checkmarx Scope Wider Than Reported, CISA KEV Entry, and Detection Tools Available, (Thu, Mar 26th)

  isc.sans.edu · Mar 26, 2026
• 
  CISA Adds CVE-2026-33634 to Known Exploited Vulnerabilities Catalogue

  cisa.gov · Mar 26, 2026
• 
  TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

  thehackernews.com · Mar 24, 2026