CWE-506

Newest addition to KEV first.

• CVE-2026-48027

  Compromised Nx Console version 18.95.0

  nrwl · nx-console

  ExploitedCritical9.3
• CVE-2026-8398

  A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…

  AVB Disc Soft · DAEMON Tools Lite

  ExploitedCritical9.3
• CVE-2026-45321

  Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

  @tanstack · arktype-adapter

  ExploitedCritical9.6
• CVE-2026-33634

  Trivy ecosystem supply chain briefly compromised

  aquasecurity · setup-trivy

  ExploitedCritical9.4
• CVE-2025-54313

  eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an…

  prettier · eslint-config-prettier

  ExploitedHigh7.5
• CVE-2025-59374

  "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…

  ASUS · live update

  ExploitedCritical9.3
• CVE-2025-30154

  Multiple Reviewdog actions were compromised during a specific time period

  reviewdog · reviewdog

  ExploitedHigh8.6
• CVE-2025-30066

  tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on…

  tj-actions · changed-files

  ExploitedHigh8.6
• CVE-2024-4978

  Malicious Code in Justice AV Solutions (JAVS) Viewer

  Justice AV Solutions · Viewer

  ExploitedHigh8.7