CWE-506

Embedded Malicious Code

22 CVEs Avg CVSS 8.7 MITRE
5
CRITICAL
13
HIGH
2
MEDIUM
0
LOW
4
POC
3
KEV

Monthly

CVE-2026-34424 CRITICAL Act Now

Supply chain compromise in Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla delivers multi-stage remote access toolkit via compromised update mechanism. Unauthenticated attackers achieve pre-authentication remote code execution through malicious HTTP headers, deploy authenticated backdoors accepting arbitrary PHP/OS commands, create hidden administrator accounts, exfiltrate credentials and API keys, and establish persistence via must-use plugins and core file modifications. Vendor confirmed malicious build distributed through official update channel. No public exploit identified at time of analysis.

RCE WordPress PHP
NVD
CVSS 4.0
9.3
EPSS
0.2%
CVE-2026-33634 CRITICAL POC KEV PATCH THREAT GHSA Emergency

Trivy security scanner v0.69.4 was compromised in a supply chain attack where a threat actor used stolen credentials to publish malicious releases and force-push credential-stealing malware to GitHub Actions repositories.

Information Disclosure
NVD GitHub VulDB
CVSS 4.0
9.4
EPSS
0.0%
Threat
4.9
CVE-2026-31976 Monitor

xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the un...

Github
NVD GitHub VulDB
EPSS
0.1%
CVE-2026-28353 Monitor

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities.

Information Disclosure
NVD GitHub
EPSS
0.1%
CVE-2024-10938 MEDIUM This Month

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. [CVSS 6.5 MEDIUM]

WordPress PHP
NVD
CVSS 3.1
6.5
EPSS
0.1%
CVE-2025-55556 MEDIUM POC This Week

TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Information Disclosure Tensorflow AI / ML Redhat
NVD GitHub
CVSS 3.1
6.5
EPSS
0.0%
CVE-2025-10894 CRITICAL MAL This Week

Malicious code was inserted into the Nx (build system) package and several related plugins. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVSS 3.1
9.6
EPSS
0.1%
CVE-2025-59145 HIGH PATCH MAL This Month

color-name is a JSON with CSS color names. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVSS 4.0
8.8
EPSS
0.1%
CVE-2025-59331 HIGH PATCH MAL This Week

is-arrayish checks if an object can be used like an Array. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVSS 4.0
8.8
EPSS
0.1%
CVE-2025-59330 HIGH PATCH MAL This Week

error-ex allows error subclassing and stack customization. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVSS 4.0
8.8
EPSS
0.1%
CVE-2026-34424
EPSS 0% CVSS 9.3
CRITICAL Act Now

Supply chain compromise in Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla delivers multi-stage remote access toolkit via compromised update mechanism. Unauthenticated attackers achieve pre-authentication remote code execution through malicious HTTP headers, deploy authenticated backdoors accepting arbitrary PHP/OS commands, create hidden administrator accounts, exfiltrate credentials and API keys, and establish persistence via must-use plugins and core file modifications. Vendor confirmed malicious build distributed through official update channel. No public exploit identified at time of analysis.

RCE WordPress PHP
NVD
CVE-2026-33634
EPSS 0% 4.9 CVSS 9.4
CRITICAL POC KEV PATCH THREAT Emergency

Trivy security scanner v0.69.4 was compromised in a supply chain attack where a threat actor used stolen credentials to publish malicious releases and force-push credential-stealing malware to GitHub Actions repositories.

Information Disclosure
NVD GitHub VulDB
CVE-2026-31976
EPSS 0%
Monitor

xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the un...

Github
NVD GitHub VulDB
CVE-2026-28353
EPSS 0%
Monitor

Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities.

Information Disclosure
NVD GitHub
CVE-2024-10938
EPSS 0% CVSS 6.5
MEDIUM This Month

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. [CVSS 6.5 MEDIUM]

WordPress PHP
NVD
CVE-2025-55556
EPSS 0% CVSS 6.5
MEDIUM POC This Week

TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Information Disclosure Tensorflow AI / ML +1
NVD GitHub
CVE-2025-10894
EPSS 0% CVSS 9.6
CRITICAL This Week

Malicious code was inserted into the Nx (build system) package and several related plugins. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVE-2025-59145
EPSS 0% CVSS 8.8
HIGH PATCH This Month

color-name is a JSON with CSS color names. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVE-2025-59331
EPSS 0% CVSS 8.8
HIGH PATCH This Week

is-arrayish checks if an object can be used like an Array. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub
CVE-2025-59330
EPSS 0% CVSS 8.8
HIGH PATCH This Week

error-ex allows error subclassing and stack customization. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Node.js Redhat
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy