CWE-506.

Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code

• RankMath Rank Math SEO PRO
• CWE-506

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

• CWE-506

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

• CWE-506

Zbtlink MQWrt yunmgrd Cloud C2 Implant

• Zbtlink L3_V2_8
• Zbtlink WE826-T2
• CWE-300
• CWE-506

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

• Hard-coded credentials
• CWE-506

>=0.6.1, <0.6.4 · fixed in 0.6.4

droundy arrayref: The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling…

• droundy arrayref
• CWE-506

droundy append-only-vec: The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when…

• droundy append-only-vec
• CWE-506

droundy internment: The internment crate 0.8.7 for Rust can trigger execution of malicious code when…

• droundy internment
• CWE-506

Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

• WPManageNinja Fluent Forms Pro
• CWE-506

Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build

• WPManageNinja Ninja Tables Pro
• CWE-506

react18-use was vulnerable to malicious code execution via compromised commits

• dai-shi react18-use
• CWE-506

react-tracked was vulnerable to malicious code execution via compromised commits

• dai-shi react-tracked
• CWE-506

use-reducer-async was vulnerable to malicious code execution via compromised commits

• dai-shi use-reducer-async
• CWE-506

use-context-selector was vulnerable to malicious code execution via compromised commits

• dai-shi use-context-selector
• CWE-506

ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

• Zbtlink CPE2801 Firmware
• Zbtlink WE1026-5G-WD Firmware
• CWE-506

VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

• webreinvent vaahcms
• CWE-506

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter

• nico23 Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
• CWE-506

`exploration` was removed from crates.io for malicious code

• CWE-506

* · no fixed version yet

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

• CWE-506

>=0.1.8, <0.1.15 · fixed in 0.1.15

Supply chain compromise via malicious @cap-js/openapi

• CWE-506

>=1.4.1, <1.4.2 · fixed in 1.4.2

Compromised Nx Console version 18.95.0

• nrwl nx-console
• CWE-506

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

• CWE-506

>=2.2.2, <2.3.0 · fixed in 2.3.0

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

• CWE-506

>=0.1.2, <=0.1.19 · no fixed version yet

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

• CWE-506

=0.10.1 · no fixed version yet

Malware in @opensearch-project/opensearch

• CWE-506

=3.5.3 || =3.6.2 || =3.7.0 || =3.8.0 · no fixed version yet

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

• CWE-506

=2.2.2 || =2.2.3 || =2.2.4 · no fixed version yet

Malicious dropper in mistralai 2.4.6 PyPI package

• CWE-506

=2.4.6 · no fixed version yet

AVB Disc Soft DAEMON Tools Lite: A supply chain attack compromised the official installation packages of DAEMON Tools Lite…

• AVB Disc Soft DAEMON Tools Lite
• CWE-506

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

• CWE-506

>=1.166.12, <1.166.16 || >=1.166.15, <1.166.16 · fixed in 1.166.16

Compromised version of intercom-client published to npm

• CWE-506

=7.0.4 · no fixed version yet

Compromised tag of intercom-php published via GitHub

• CWE-506

=5.0.2 · no fixed version yet

Compromise of PyTorch Lightning PyPi Package Versions

• CWE-506
• CWE-829

=2.6.2 || =2.6.3 · no fixed version yet

`mysten-metrics` was removed from crates.io for malicious code

• CWE-506

* · no fixed version yet

`sui-execution-cut` was removed from crates.io for malicious code

• CWE-506

* · no fixed version yet

Essentialplugin Plugins (Various Versions) - Injected Backdoor

• essentialplugin Accordion and Accordion Slider
• essentialplugin Portfolio and Projects
• CWE-506

Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

• Nextendweb Smart Slider 3 Pro for WordPress
• Nextendweb Smart Slider 3 Pro for Joomla
• CWE-506

Axios npm Supply Chain Incident Impacting @usebruno/cli

• CWE-494
• CWE-506

<3.2.1 · fixed in 3.2.1

Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

• CWE-506

>=4.87.1, <=4.87.2 · no fixed version yet

Two LiteLLM versions published containing credential harvesting malware

• CWE-506

>=1.82.7, <=1.82.8 · no fixed version yet

Trivy ecosystem supply chain was briefly compromised

• CWE-506

=0.69.4 · no fixed version yet

xygeni-action v5 tag poisoned with C2 backdoor

• xygeni-action
• CWE-506

Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

• aquasecurity trivy-vscode-extension
• CWE-506

OVRI Payment 1.7.0 - Malicious .htaccess directive

• moneytigo OVRI Payment
• CWE-506

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

• CWE-506

>=1.1.5.post1 · no fixed version yet

ASUS live update: "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were…

• ASUS live update
• CWE-506

VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise

• Vesta Control Panel (CP)
• CWE-506

NetSarang v5.0 Malicious Backdoor Supply Chain Compromise

• NetSarang Computer, Inc. Xmanager Enterprise
• NetSarang Computer, Inc. Xmanager
• CWE-506

Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

• Web Developer for Chrome
• CWE-506

CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise

• Piriform CCleaner
• Piriform CCleaner Cloud
• CWE-506

Duplicate Advisory: Malicious versions of Nx were published

• CWE-506

=21.5.0 · no fixed version yet

TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.

• CWE-506

Nx: nx/devkit: malicious versions of nx and plugins published to npm

• Red Hat Multicluster Global Hub
• Red Hat OpenShift Serverless
• CWE-506

[email protected] contains malware after npm account takeover

• colorjs color-name
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- node-is-arrayish
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- node-error-ex
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- color-convert
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- color-string
• CWE-506

[email protected] contains malware after npm account takeover

• debug
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- color
• CWE-506

[email protected] contains malware after npm account takeover

• Qix- node-simple-swizzle
• CWE-506