CVE-2026-73533 | Critical | 9.8 | 2026-08-13 | Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-73532 | Critical | 9.8 | 2026-08-13 | Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server… |
CVE-2026-48161 | | | 2026-08-10 | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f… |
CVE-2026-48160 | | | 2026-08-10 | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6… |
CVE-2026-48159 | | | 2026-08-10 | use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits… |
CVE-2026-48158 | | | 2026-08-10 | use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious… |
CVE-2026-66747 | Critical | 9.8 | 2026-08-05 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source… |
CVE-2026-67595 | High | 8.1 | 2026-07-29 | VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP em… |
CVE-2026-18072 | Critical | 9.8 | 2026-07-29 | The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded B… |
CVE-2026-46412 | Critical | 10.0 | 2026-07-20 | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:5… |
CVE-2026-46421 | | | 2026-07-15 | The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database ser… |
CVE-2026-45758 | Critical | 9.6 | 2026-06-05 | Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious versi… |
CVE-2026-48027 | Critical | 9.8 | 2026-05-27 | Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon aft… |
CVE-2026-8398 | Critical | 9.8 | 2026-05-15 | A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… |
CVE-2026-44484 | Critical | 9.8 | 2026-05-14 | PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a cre… |
CVE-2026-45321 | Critical | 9.6 | 2026-05-12 | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishe… |
CVE-2026-6443 | Critical | 9.8 | 2026-04-17 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious th… |
CVE-2026-34424 | Critical | 9.8 | 2026-04-09 | Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that all… |
CVE-2026-34841 | Critical | 9.8 | 2026-04-06 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the a… |
CVE-2026-33634 | High | 8.8 | 2026-03-23 | Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 v… |
CVE-2026-31976 | Critical | 9.8 | 2026-03-11 | xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (… |
CVE-2026-28353 | | | 2026-03-05 | Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX… |
CVE-2024-10938 | Medium | 6.5 | 2026-02-27 | The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scr… |
CVE-2025-59374 | Critical | 9.8 | 2025-12-17 | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… |
CVE-2018-25117 | | | 2025-10-15 | VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installat… |
CVE-2017-20203 | | | 2025-10-09 | NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious… |
CVE-2017-20202 | | | 2025-10-08 | Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded… |
CVE-2017-20201 | | | 2025-10-08 | CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit builds) contained a malicious pre-entry-point loader that diverts execution from __scrt_common_main_s… |
CVE-2025-55556 | Medium | 6.5 | 2025-09-25 | TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. |
CVE-2025-10894 | Critical | 9.6 | 2025-09-24 | Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, vi… |
CVE-2025-59145 | | | 2025-09-15 | color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1… |
CVE-2025-59331 | | | 2025-09-15 | is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attac… |
CVE-2025-59330 | | | 2025-09-15 | error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack… |
CVE-2025-59162 | | | 2025-09-15 | color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a… |
CVE-2025-59144 | | | 2025-09-15 | debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was pu… |
CVE-2025-59143 | | | 2025-09-15 | color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing atta… |
CVE-2025-59142 | | | 2025-09-15 | color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing… |
CVE-2025-59141 | | | 2025-09-15 | simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version… |
CVE-2025-59140 | | | 2025-09-15 | backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0… |
CVE-2025-59039 | | | 2025-09-09 | Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related m… |
CVE-2025-59038 | | | 2025-09-09 | Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by… |
CVE-2025-59037 | | | 2025-09-09 | DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malwar… |
CVE-2025-8217 | Medium | 4.0 | 2025-07-30 | The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes whe… |
CVE-2025-54313 | High | 7.5 | 2025-07-19 | eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an… |
CVE-2025-32965 | | | 2025-04-22 | xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were… |
CVE-2025-30154 | High | 8.6 | 2025-03-19 | reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with… |
CVE-2025-30066 | High | 8.6 | 2025-03-15 | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-1… |
CVE-2024-4978 | High | 8.4 | 2024-05-23 | Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, priv… |
CVE-2024-3094 | Critical | 10.0 | 2024-03-29 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build proces… |
CVE-2023-2003 | Critical | 9.1 | 2023-07-13 | Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encode… |
CVE-2021-22887 | Low | 2.3 | 2021-03-16 | A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerab… |
CVE-2020-15165 | Critical | 9.3 | 2020-08-28 | Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official ma… |
CVE-2017-16207 | High | 7.3 | 2018-06-07 | discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. |
CVE-2017-16205 | High | 7.5 | 2018-06-07 | The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16204 | High | 7.5 | 2018-06-07 | The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16203 | High | 7.5 | 2018-06-07 | The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16202 | High | 7.5 | 2018-06-07 | The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16128 | Critical | 9.8 | 2018-06-07 | The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
CVE-2017-16081 | High | 7.5 | 2018-06-07 | cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16080 | High | 7.5 | 2018-06-07 | nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16079 | High | 7.5 | 2018-06-07 | smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16078 | High | 7.5 | 2018-06-07 | shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16077 | High | 7.5 | 2018-06-07 | mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16076 | High | 7.5 | 2018-06-07 | proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16075 | High | 7.5 | 2018-06-07 | http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16074 | High | 7.5 | 2018-06-07 | crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16073 | High | 7.5 | 2018-06-07 | noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16072 | High | 7.5 | 2018-06-07 | nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16071 | High | 7.5 | 2018-06-07 | nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16070 | High | 7.5 | 2018-06-07 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16069 | High | 7.5 | 2018-06-07 | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16068 | High | 7.5 | 2018-06-07 | ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16067 | High | 7.5 | 2018-06-07 | node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16066 | High | 7.5 | 2018-06-07 | opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16065 | High | 7.5 | 2018-06-07 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16064 | High | 7.5 | 2018-06-07 | node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16063 | High | 7.5 | 2018-06-07 | node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16060 | High | 7.5 | 2018-06-07 | babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16059 | High | 7.5 | 2018-06-07 | mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16058 | High | 7.5 | 2018-06-07 | gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16057 | High | 7.5 | 2018-06-07 | nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16056 | High | 7.5 | 2018-06-07 | mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16055 | High | 7.5 | 2018-06-04 | `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16054 | High | 7.5 | 2018-06-04 | `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16053 | High | 7.5 | 2018-06-04 | `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16052 | High | 7.5 | 2018-06-04 | `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16051 | High | 7.5 | 2018-06-04 | `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16050 | High | 7.5 | 2018-06-04 | `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16049 | High | 7.5 | 2018-06-04 | `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16048 | High | 7.5 | 2018-06-04 | `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16046 | High | 7.5 | 2018-06-04 | `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16045 | High | 7.5 | 2018-06-04 | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16044 | High | 7.5 | 2018-06-04 | `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16062 | High | 7.5 | 2018-05-29 | node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16061 | High | 7.5 | 2018-05-29 | tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16047 | High | 7.5 | 2018-05-29 | mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |