CVE Vulnerability Advisory Database

[Affected Scope] Nx Console extension version 18.95.0 distributed via VS Code Marketplace and OpenVSX

[Impact] Execution of arbitrary malicious code within the developer's local environment, potentially leading to credential theft and full system compromise

[Mitigation] Immediately uninstall the compromised version 18.95.0 and upgrade to the clean version 18.100.0 or higher

[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026

[Impact] Attackers compromised the vendor's infrastructure to distribute trojanized binaries signed with a legitimate certificate, bypassing security controls to establish backdoor access

[Mitigation] Immediately uninstall the compromised versions, perform a full system malware scan, and reinstall the clean, patched version from the official vendor

[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11

[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens

[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-33634

[Impact] Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, fo...

[Mitigation] Apply vendor security patches and restrict external network exposure.