agentprime: CWE-506

CVE-2026-111862: Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code

Mon, 19 Oct 2026 16:35:59 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

Thu, 24 Sep 2026 22:36:50 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Tue, 22 Sep 2026 18:21:23 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-74232: Zbtlink MQWrt yunmgrd Cloud C2 Implant

Thu, 27 Aug 2026 10:39:14 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Wed, 26 Aug 2026 14:36:45 GMT

pantheon-agents >=0.6.1, <0.6.4, fixed in 0.6.4. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-77651: droundy arrayref: The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling…

Fri, 21 Aug 2026 00:41:36 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77650: droundy append-only-vec: The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when…

Fri, 21 Aug 2026 00:40:26 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77649: droundy internment: The internment crate 0.8.7 for Rust can trigger execution of malicious code when…

Fri, 21 Aug 2026 00:39:02 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73532: Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

Thu, 13 Aug 2026 16:01:19 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73533: Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build

Thu, 13 Aug 2026 16:00:48 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48161: react18-use was vulnerable to malicious code execution via compromised commits

Mon, 10 Aug 2026 22:27:35 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48160: react-tracked was vulnerable to malicious code execution via compromised commits

Mon, 10 Aug 2026 21:08:54 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48159: use-reducer-async was vulnerable to malicious code execution via compromised commits

Mon, 10 Aug 2026 17:55:45 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48158: use-context-selector was vulnerable to malicious code execution via compromised commits

Mon, 10 Aug 2026 15:56:59 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66747: ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

Wed, 05 Aug 2026 10:50:45 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-67595: VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

Wed, 29 Jul 2026 21:33:25 GMT

CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18072: Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter

Wed, 29 Jul 2026 03:31:08 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

`exploration` was removed from crates.io for malicious code

Fri, 10 Jul 2026 19:32:24 GMT

exploration *, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Fri, 26 Jun 2026 20:51:20 GMT

semantic-router >=0.1.8, <0.1.15, fixed in 0.1.15. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Supply chain compromise via malicious @cap-js/openapi

Thu, 04 Jun 2026 19:37:04 GMT

@cap-js/openapi >=1.4.1, <1.4.2, fixed in 1.4.2. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-48027: Compromised Nx Console version 18.95.0

Wed, 27 May 2026 15:50:01 GMT

CVSS 9.3 (Critical). Critical: In CISA’s KEV catalogue since 27 May 2026: it is known to be exploited. CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

Wed, 20 May 2026 15:33:04 GMT

@cap-js/sqlite >=2.2.2, <2.3.0, fixed in 2.3.0. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

Tue, 19 May 2026 20:28:07 GMT

@beproduct/nestjs-auth >=0.1.2, <=0.1.19, no fixed version yet. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Tue, 19 May 2026 15:40:44 GMT

guardrails-ai =0.10.1, no fixed version yet. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Malware in @opensearch-project/opensearch

Tue, 19 May 2026 14:35:05 GMT

@opensearch-project/opensearch =3.5.3 || =3.6.2 || =3.7.0 || =3.8.0, no fixed version yet. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Mon, 18 May 2026 17:55:53 GMT

@mistralai/mistralai =2.2.2 || =2.2.3 || =2.2.4, no fixed version yet. CVSS 0.0 (None). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Malicious dropper in mistralai 2.4.6 PyPI package

Mon, 18 May 2026 17:55:27 GMT

mistralai =2.4.6, no fixed version yet. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-8398: AVB Disc Soft DAEMON Tools Lite: A supply chain attack compromised the official installation packages of DAEMON Tools Lite…

Fri, 15 May 2026 07:30:29 GMT

CVSS 9.3 (Critical). Critical: In CISA’s KEV catalogue since 27 May 2026: it is known to be exploited. CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Tue, 12 May 2026 00:12:49 GMT

@tanstack/arktype-adapter >=1.166.12, <1.166.16 || >=1.166.15, <1.166.16, fixed in 1.166.16. CVSS 9.6 (Critical). Critical: In CISA’s KEV catalogue since 27 May 2026: it is known to be exploited. CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Compromised version of intercom-client published to npm

Thu, 07 May 2026 17:32:48 GMT

intercom-client =7.0.4, no fixed version yet. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Compromised tag of intercom-php published via GitHub

Thu, 07 May 2026 16:48:41 GMT

intercom/intercom-php =5.0.2, no fixed version yet. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Compromise of PyTorch Lightning PyPi Package Versions

Thu, 07 May 2026 00:52:55 GMT

pytorch-lightning =2.6.2 || =2.6.3, no fixed version yet. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`mysten-metrics` was removed from crates.io for malicious code

Mon, 04 May 2026 21:43:56 GMT

mysten-metrics *, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`sui-execution-cut` was removed from crates.io for malicious code

Mon, 04 May 2026 21:42:55 GMT

sui-execution-cut *, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-6443: Essentialplugin Plugins (Various Versions) - Injected Backdoor

Fri, 17 Apr 2026 06:44:49 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-34424: Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

Thu, 09 Apr 2026 22:59:38 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Axios npm Supply Chain Incident Impacting @usebruno/cli

Thu, 02 Apr 2026 18:34:04 GMT

@usebruno/cli <3.2.1, fixed in 3.2.1. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

Mon, 30 Mar 2026 19:15:30 GMT

telnyx >=4.87.1, <=4.87.2, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Two LiteLLM versions published containing credential harvesting malware

Wed, 25 Mar 2026 14:25:42 GMT

litellm >=1.82.7, <=1.82.8, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Trivy ecosystem supply chain was briefly compromised

Tue, 24 Mar 2026 17:53:12 GMT

github.com/aquasecurity/trivy =0.69.4, no fixed version yet. CVSS 9.4 (Critical). Critical: In CISA’s KEV catalogue since 26 Mar 2026: it is known to be exploited. CVSS score 9.4: 9.0 or more. CVSS score 9.4 (7.0 or more) and EPSS 0.60 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-31976: xygeni-action v5 tag poisoned with C2 backdoor

Wed, 11 Mar 2026 19:44:38 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-28353: Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release

Thu, 05 Mar 2026 20:02:59 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-10938: OVRI Payment 1.7.0 - Malicious .htaccess directive

Fri, 27 Feb 2026 09:23:42 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

Fri, 06 Feb 2026 19:37:26 GMT

dydx-v4-client >=1.1.5.post1, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-59374: ASUS live update: "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were…

Wed, 17 Dec 2025 04:27:06 GMT

CVSS 9.3 (Critical). Critical: In CISA’s KEV catalogue since 17 Dec 2025: it is known to be exploited. CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2018-25117: VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise

Wed, 15 Oct 2025 01:23:35 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2017-20203: NetSarang v5.0 Malicious Backdoor Supply Chain Compromise

Thu, 09 Oct 2025 17:01:08 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2017-20202: Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise

Wed, 08 Oct 2025 22:04:12 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2017-20201: CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise

Wed, 08 Oct 2025 22:04:08 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Duplicate Advisory: Malicious versions of Nx were published

Thu, 25 Sep 2025 00:30:27 GMT

nx =21.5.0, no fixed version yet. CVSS 9.6 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.