aquasecurity trivy-action

• CVE-2026-33634 Critical 9.4 Exploited Trivy ecosystem supply chain briefly compromised 59.7%
• CVE-2026-26189 Medium 5.9 Trivy Action has a script injection via sourced env file in composite action 1.5%