The product contains code that appears to be malicious in nature.
89 vulnerabilities with CWE-506
CVE-2026-67595
HIGH
VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
CVSS 8.1
CVE-2026-18072
CRITICAL
Advanced Responsive Video Embedder For Rumble, Odysee, YouTube, Vimeo, Kick … < 10.8.7 - Authentication Bypass
CVSS 9.8
CVE-2026-46412
CRITICAL
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
CVSS 10.0
CVE-2026-46421
CRITICAL
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
CVE-2026-45758
CRITICAL
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
CVSS 9.6
CVE-2026-48027
CRITICAL
KEV
Compromised Nx Console version 18.95.0
CVSS 9.8
CVE-2026-8398
CRITICAL
KEV
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer
CVSS 9.8
CVE-2026-44484
CRITICAL
Compromise of PyTorch Lightning PyPi Package Versions
CVSS 9.8
CVE-2026-45321
CRITICAL
KEV
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVSS 9.6
CVE-2026-6443
CRITICAL
Accordion and Accordion Slider 1.4.6 - Injected Backdoor
CVSS 9.8
CVE-2026-34424
CRITICAL
Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit
CVSS 9.8
CVE-2026-34841
CRITICAL
Axios npm Supply Chain Incident Impacting @usebruno/cli
CVSS 9.8
CVE-2026-33634
HIGH
KEV
Trivy ecosystem supply chain briefly compromised
CVSS 8.8
CVE-2026-31976
CRITICAL
xygeni-action 5.38.0-6.4.0 - Supply Chain Compromise via Git Tag Poisoning
CVSS 9.8
CVE-2026-28353
CRITICAL
Trivy VSCode Extension 1.8.12 - Code Injection
CVE-2025-59374
CRITICAL
KEV
ASUS Live Update - Unintended Actions
CVSS 9.8
CVE-2025-55556
MEDIUM
TensorFlow <2.18.0 - Info Disclosure
CVSS 6.5
CVE-2025-10894
CRITICAL
Nx Build System and Plugins - Malicious Code Injection via npm
CVSS 9.6
CVE-2025-59145
HIGH
color-name 2.0.1 - Embedded Malicious Code via Compromised npm Package
CVE-2025-59331
HIGH
is-arrayish <0.3.3 - Code Injection
CVE-2025-59330
HIGH
error-ex 1.3.3 - Embedded Malicious Code via Compromised npm Package
CVE-2025-59162
HIGH
color-convert 3.1.1 - Command Injection
CVE-2025-59144
HIGH
debug 4.4.2 - Embedded Malicious Code via Compromised npm Package
CVE-2025-59143
HIGH
color 5.0.1 - Embedded Malicious Code via Compromised npm Package
CVE-2025-59142
HIGH
color-string 2.1.1 - Embedded Malicious Code via Compromised npm Package
Details
Vulnerabilities
89