Vulnerability database

12 results

• May 27, 2026Nx Console Embedded Malicious Code VulnerabilityCVE-2026-48027 · Other software · Nx · reported by GitHubExploitedRansomwareCritical 9.3

  Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.

  Product

  Nx Console

  On CISA’s list since

  May 27, 2026 (federal fix deadline Jun 10, 2026)

  What to do

  Attackers are using this now. Install Nx’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• May 27, 2026Daemon Tools Lite Embedded Malicious Code VulnerabilityCVE-2026-8398 · Other software · Daemon · reported by vulnerability@kaspersky.comExploitedCritical 9.3

  Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.

  Product

  Daemon Tools Lite

  On CISA’s list since

  May 27, 2026 (federal fix deadline May 30, 2026)

  What to do

  Attackers are using this now. Install Daemon’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblog.daemon-tools.ccsecurelist.com

• Mar 26, 2026Aquasecurity Trivy Embedded Malicious Code VulnerabilityCVE-2026-33634 · Other software · Aquasecurity · reported by GitHubExploitedCritical 9.4

  Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database passwords, and any sensitive configuration in memory.

  Product

  Trivy

  On CISA’s list since

  Mar 26, 2026 (federal fix deadline Apr 9, 2026)

  What to do

  Attackers are using this now. Install Aquasecurity’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogdocs.litellm.aifuturesearch.ai

• Jan 22, 2026Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityCVE-2025-54313 · Other software · Prettier · reported by MITREExploitedHigh 7.5

  Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

  Product

  eslint-config-prettier

  On CISA’s list since

  Jan 22, 2026 (federal fix deadline Feb 12, 2026)

  What to do

  Attackers are using this now. Install Prettier’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comnews.ycombinator.com

• Dec 17, 2025ASUS Live Update Embedded Malicious Code VulnerabilityCVE-2025-59374 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1ExploitedCritical 9.3

  ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

  Product

  Live Update

  On CISA’s list since

  Dec 17, 2025 (federal fix deadline Jan 7, 2026)

  What to do

  Attackers are using this now. Install ASUS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogasus.comcisa.gov

• Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6

  reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.

  Product

  action-setup GitHub Action

  On CISA’s list since

  Mar 24, 2025 (federal fix deadline Apr 14, 2025)

  What to do

  Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloggithub.comgithub.com

• Mar 18, 2025tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30066 · Other software · tj-actions · reported by MITREExploitedHigh 8.6

  tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens (PATs), npm tokens, and private RSA keys.

  Product

  changed-files GitHub Action

  On CISA’s list since

  Mar 18, 2025 (federal fix deadline Apr 8, 2025)

  What to do

  Attackers are using this now. Install tj-actions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblog.gitguardian.comgithub.com

• May 29, 2024Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityCVE-2024-4978 · Other software · Justice AV Solutions · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedHigh 8.7

  Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

  Product

  Viewer

  On CISA’s list since

  May 29, 2024 (federal fix deadline Jun 19, 2024)

  What to do

  Attackers are using this now. Install Justice AV Solutions’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogtwitter.comjavs.com

• Mar 25, 2022Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityCVE-2014-6332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8

  OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.

  Product

  Windows

  On CISA’s list since

  Mar 25, 2022 (federal fix deadline Apr 15, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

• Mar 3, 2022Oracle Java SE and Java SE Embedded Remote Code Execution VulnerabilityCVE-2015-2590 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8

  An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.

  Product

  Java SE

  On CISA’s list since

  Mar 3, 2022 (federal fix deadline Mar 24, 2022)

  What to do

  Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.opensuse.orglists.opensuse.org

• Mar 3, 2022Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution VulnerabilityCVE-2014-4114 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8

  A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.

  Product

  Windows

  On CISA’s list since

  Mar 3, 2022 (federal fix deadline Mar 24, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogblog.trendmicro.comblogs.technet.com

• Dec 10, 2021Embedthis GoAhead Remote Code Execution VulnerabilityCVE-2017-17562 · Other software · Embedthis · reported by MITREExploitedHigh 8.1

  Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

  Product

  GoAhead

  On CISA’s list since

  Dec 10, 2021 (federal fix deadline Jun 10, 2022)

  What to do

  Attackers are using this now. Install Embedthis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogoracle.comsecuritytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.