CWE-506
103 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 9 of them as exploited in the wild.
- Published CVEs
- 103
- Last 12 months
- 31
- Critical
- 40
- Known exploited
- 9
Critical 40High 59Medium 3Low 1Not scored 0
CVEs per yearBy the year they were published
- 20201
- 20211
- 20231
- 202520
- 20251
- 202547
- 202629
- 20263
Known exploitedNewest addition to KEV first
- CVE-2026-48027
Compromised Nx Console version 18.95.0
nrwl · nx-console
ExploitedCritical9.3 - CVE-2026-8398
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…
AVB Disc Soft · DAEMON Tools Lite
ExploitedCritical9.3 - CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6 - CVE-2026-33634
Trivy ecosystem supply chain briefly compromised
aquasecurity · setup-trivy
ExploitedCritical9.4 - CVE-2025-54313
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an…
prettier · eslint-config-prettier
ExploitedHigh7.5 - CVE-2025-59374
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…
ASUS · live update
ExploitedCritical9.3 - CVE-2025-30154
Multiple Reviewdog actions were compromised during a specific time period
reviewdog · reviewdog
ExploitedHigh8.6 - CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on…
tj-actions · changed-files
ExploitedHigh8.6 - CVE-2024-4978
Malicious Code in Justice AV Solutions (JAVS) Viewer
Justice AV Solutions · Viewer
ExploitedHigh8.7
Newest CVEs
- CVE-2026-111862
Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
RankMath · Rank Math SEO PRO
Critical9.8 - CVE-2026-97230
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL
IO-Socket-SSL-SelfCertificate
Critical9.8 - CVE-2026-95831
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt-SelfCertificate
High7.8 - CVE-2026-74232
Zbtlink MQWrt yunmgrd Cloud C2 Implant
Zbtlink · L3_V2_8
Critical9.3 - CVE-2026-77651
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that…
droundy · arrayref
Critical9.8 - CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue…
droundy · append-only-vec
Critical9.8 - CVE-2026-77649
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency…
droundy · internment
Critical9.8 - CVE-2026-73532
Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build
WPManageNinja · Fluent Forms Pro
Critical9.3 - CVE-2026-73533
Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build
WPManageNinja · Ninja Tables Pro
Critical9.3 - CVE-2026-48161
react18-use was vulnerable to malicious code execution via compromised commits
dai-shi · react18-use
Critical9.3