CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Nx Console VS Code Extension Supply Chain Compromise and Malicious Code Injection (CVE-2026-48027)
[Affected Scope] Nx Console extension version 18.95.0 distributed via VS Code Marketplace and OpenVSX
[Impact] Execution of arbitrary malicious code within the developer's local environment, potentially leading to credential theft and full system compromise
[Mitigation] Immediately uninstall the compromised version 18.95.0 and upgrade to the clean version 18.100.0 or higher
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
[Impact] Attackers compromised the vendor's infrastructure to distribute trojanized binaries signed with a legitimate certificate, bypassing security controls to establish backdoor access
[Mitigation] Immediately uninstall the compromised versions, perform a full system malware scan, and reinstall the clean, patched version from the official vendor
GitHub Actions reviewdog/action-setup Supply Chain Compromise and Secrets Leak (CVE-2025-30154)
[Affected Scope] Workflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC
[Impact] Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft
[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes
tj-actions changed-files GitHub Action Supply Chain Compromise and Malicious Code Injection (CVE-2025-30066)
[Affected Scope] GitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7
[Impact] Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs
[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA
Justice AV Solutions (JAVS) Viewer Supply Chain Attack & Backdoor Vulnerability (CVE-2024-4978)
[Affected Scope] Justice AV Solutions (JAVS) Viewer Setup version 8.3.7.250-1.
[Impact] A remote, privileged threat actor can execute unauthorized PowerShell commands and gain full control over the affected system via a signed malicious binary.
[Mitigation] Immediately uninstall the compromised software and reinstall a clean, verified version from the official vendor website.