Skip to content
Noroxi

CWE-506 · 454 records

Embedded Malicious Code

CVEs in this class

454 records

  • CVE-2025-30066
    86Now

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs.

    HighCVSS 8.6KEVWeaponizedEPSS 72%

    tj-actions · changed-filesMar 15, 2025

  • CVE-2026-33634
    85Now

    Trivy ecosystem supply chain briefly compromised

    CriticalCVSS 9.4KEVWeaponizedEPSS 59%

    aquasec · setup-trivyMar 23, 2026

  • CVE-2024-4978
    72This week

    Malicious Code in Justice AV Solutions (JAVS) Viewer

    HighCVSS 8.7KEVWeaponizedEPSS 26%

    javs · javs viewerMay 22, 2024

  • CVE-2026-45321
    69This week

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    CriticalCVSS 9.6KEVWeaponizedEPSS 3%

    tanstack · tanstack/arktype-adapterMay 12, 2026

  • CVE-2026-48027
    68This week

    Compromised Nx Console version 18.95.0

    CriticalCVSS 9.3KEVWeaponizedEPSS 1%

    nx · nx consoleMay 27, 2026

  • CVE-2024-3094
    67This week

    Xz: malicious code in distributed source

    CriticalCVSS 10.0Proof of conceptEPSS 90%

    tukaani · xzMar 29, 2024

  • CVE-2026-8398
    67This week

    A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)

    CriticalCVSS 9.3KEVWeaponizedEPSS 1%

    disc-soft · daemon toolsMay 15, 2026

  • CVE-2025-59374
    67This week

    "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro

    CriticalCVSS 9.3KEVWeaponizedEPSS 1%

    asus · live updateDec 17, 2025

  • CVE-2025-30154
    65This week

    Multiple Reviewdog actions were compromised during a specific time period

    HighCVSS 8.6KEVWeaponizedEPSS 2%

    reviewdog · action-ast-grepMar 19, 2025

  • CVE-2025-54313
    62This week

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise.

    HighCVSS 7.5KEVWeaponizedEPSS 5%

    prettier · eslint-config-prettierJul 19, 2025

  • CVE-2026-18072
    40Plan

    Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    nico23 · advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick …Jul 29, 2026

  • CVE-2024-6297
    40Plan

    Several WordPress.org Plugins <= Various Versions - Injected Backdoor

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    warfareplugins · social sharing plugin – social warfareJun 25, 2024

  • CVE-2026-46412
    40Plan

    Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

    CriticalCVSS 10.0No exploitEPSS 0%

    beproduct · beproduct-org-nestjs-authJul 20, 2026

  • CVE-2026-28353
    40Plan

    Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

    CriticalCVSS 10.0No exploitEPSS 0%

    aquasecurity · trivy-vscode-extensionMar 5, 2026

  • CVE-2017-16128
    39Monitor

    The module npm-script-demo opened a connection to a command and control server.

    CriticalCVSS 9.8No exploitEPSS 1%

    npm-script-demo project · npm-script-demoJun 6, 2018

  • CVE-2023-2003
    39Monitor

    Embedded malicious code vulnerability in Unitronics Vision1210

    CriticalCVSS 9.8No exploitEPSS 0%

    unitronics · vision1210 firmwareJul 13, 2023

  • CVE-2026-77649
    39Monitor

    The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a r

    CriticalCVSS 9.8No exploitEPSS 0%

    droundy · internmentAug 21, 2026

  • CVE-2026-77651
    39Monitor

    The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a ro

    CriticalCVSS 9.8No exploitEPSS 0%

    droundy · arrayrefAug 21, 2026

  • CVE-2026-77650
    39Monitor

    The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it ha

    CriticalCVSS 9.8No exploitEPSS 0%

    droundy · append-only-vecAug 21, 2026

  • CVE-2026-111862
    39Monitor

    Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code

    CriticalCVSS 9.8No exploitEPSS 0%

    rankmath · rank math seo proOct 19, 2026

  • CVE-2026-6443
    39Monitor

    Essentialplugin Plugins (Various Versions) - Injected Backdoor

    CriticalCVSS 9.8No exploitEPSS 0%

    essentialplugin · accordion and accordion sliderApr 17, 2026

  • CVE-2026-97230
    39Monitor

    IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

    CriticalCVSS 9.8No exploitEPSS 0%

    Sep 24, 2026

  • GHSA-gpg2-7r7j-4pm9
    39Monitor

    Malicious Package in buffer-xob

    CriticalCVSS 9.8No exploit

    npm · buffer-xobSep 3, 2020

  • GHSA-377f-vvrc-9wgg
    39Monitor

    Malicious Package in zemen

    CriticalCVSS 9.8No exploit

    npm · zemenSep 3, 2020

  • GHSA-88xx-23mf-rcj2
    39Monitor

    Malicious Package in bs-sha3

    CriticalCVSS 9.8No exploit

    npm · bs-sha3Sep 3, 2020

All vulnerability classes