CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens
[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials
Aqua Security Trivy Supply Chain Attack and Malicious Release (CVE-2026-33634) Critical Security Advisory
[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6
[Impact] A threat actor used compromised credentials to force-push malicious commits to version tags, enabling credential exfiltration from CI/CD pipelines
[Mitigation] Upgrade to safe versions (Trivy v0.69.2/v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6 recreated) and pin actions to immutable commit SHAs
ASUS Live Update Client Supply Chain Compromise and Malicious Code Insertion Vulnerability (CVE-2025-59374) Advisory
[Affected Scope] Specific versions of the ASUS Live Update client distributed prior to its End-of-Support (EOS) in October 2021
[Impact] Unauthorized modifications introduced via a supply chain compromise allow remote code execution and unintended malicious actions on targeted devices
[Mitigation] Since the product is End-of-Support, immediately uninstall the software and block update server communications at the network level
eslint-config-prettier Supply Chain Compromise and Malware Execution Vulnerability (CVE-2025-54313)
[Affected Scope] Windows development and build environments utilizing eslint-config-prettier package versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7
[Impact] Installation of the compromised package triggers automatic execution of install.js, dropping and executing the node-gyp.dll malware to compromise the host system
[Mitigation] Immediately uninstall the compromised versions, force-downgrade or upgrade to a clean version, and scan systems for malicious DLL files