CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
A kind of CWE-912 Hidden Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- rank math seo pro, rankmath rank math seo pro +1 more Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code 9.8 Critical
- No product listed IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL 9.8 Critical
- No product listed Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL 7.8 High
- morequick mqac-7620, mqac-7620a, mqap-7620 +12 more +14 more Zbtlink MQWrt yunmgrd Cloud C2 Implant 9.3 Critical
-
pantheon-agentsPyPI Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise) No score - droundy arrayref The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a... 9.8 Critical
- droundy append-only-vec The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a... 9.8 Critical
- droundy internment The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a... 9.8 Critical
- wpmanageninja fluent forms pro Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build 9.3 Critical
- wpmanageninja ninja tables pro Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build 9.3 Critical
- dai-shi react18-use react18-use was vulnerable to malicious code execution via compromised commits 9.3 Critical
- dai-shi react-tracked react-tracked was vulnerable to malicious code execution via compromised commits 9.3 Critical
- dai-shi use-reducer-async use-reducer-async was vulnerable to malicious code execution via compromised commits 9.3 Critical
- dai-shi use-context-selector use-context-selector was vulnerable to malicious code execution via compromised commits 9.3 Critical
- zbtlink cpe2801 firmware, we1026-5g-wd firmware, we1326 firmware +17 more +19 more ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant 9.3 Critical
- webreinvent vaahcms VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php 9.2 Critical
- nico23 advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick … Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter 9.8 Critical
-
truenpm Withdrawn Advisory: Malware in true No score -
semantic-routerPyPI semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin No score -
@cap-js/openapinpm Supply chain compromise via malicious @cap-js/openapi 9.6 Critical - nx console, nrwl nx-console +1 more Compromised Nx Console version 18.95.0 9.3 Critical
- @cap-js/db-service, cap-js @cap-js/postgres, @cap-js/sqlite +2 more Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) 9.3 Critical
- beproduct beproduct-org-nestjs-auth Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm 10.0 Critical
- guardrails ai guardrails, guardrailsai guardrails ai +1 more Malicious code in guardrails-ai 0.10.1 (supply chain compromise) 9.6 Critical
-
@mistralai/mistralainpm,@mistralai/mistralai-azurenpm,@mistralai/mistralai-gcpnpm +2 more Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp 0.0 None -
mistralaiPyPI Malicious dropper in mistralai 2.4.6 PyPI package 9.6 Critical - avb disc soft daemon tools lite, daemon tools lite, disc-soft daemon tools +2 more A supply chain attack compromised the official installation packages of DAEMON Tools Lite ... 9.3 Critical
- tanstack, @tanstack arktype-adapter, eslint-plugin-router +211 more +213 more Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys 9.6 Critical
-
intercom-clientnpm Compromised version of intercom-client published to npm 9.3 Critical -
intercom/intercom-phpPackagist Compromised tag of intercom-php published via GitHub 9.3 Critical - lightningai pytorch lightning, lightning-ai pytorch-lightning, red hat ai inference server +2 more +4 more Compromise of PyTorch Lightning PyPi Package Versions 9.3 Critical
- essential plugin featured post creative, meta slider and carousel with lightbox, portfolio and projects +19 more +21 more Essentialplugin Plugins (Various Versions) - Injected Backdoor 9.8 Critical
- nextendweb smart slider 3 pro for joomla, smart slider 3 pro for wordpress +1 more Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit 9.3 Critical
- usebruno bruno Axios npm Supply Chain Incident Impacting @usebruno/cli 9.8 Critical
-
telnyxPyPI Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2 No score -
litellmPyPI Two LiteLLM versions published containing credential harvesting malware No score - aquasec setup-trivy, trivy, aquasecurity trivy-action +3 more +5 more Trivy ecosystem supply chain briefly compromised 9.4 Critical
- xygeni xygeni-action xygeni-action v5 tag poisoned with C2 backdoor 9.3 Critical
- aquasecurity trivy-vscode-extension Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release 10.0 Critical
- moneytigo ovri payment OVRI Payment 1.7.0 - Malicious .htaccess directive 6.5 Medium
-
clinenpm Unauthorized npm publish of [email protected] with modified postinstall script No score -
dydx-v4-clientPyPI A single post-release of dydx-v4-client contained obfuscated multi-stage loader 9.3 Critical -
grepleaksnpm Withdrawn Advisory: Malware in grepleaks No score - asus live update "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with... 9.3 Critical
- vesta control panel (cp) VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise 9.3 Critical
- netsarang computer, inc. xftp, xlpd, xmanager +2 more +4 more NetSarang v5.0 Malicious Backdoor Supply Chain Compromise 9.3 Critical
- web developer for chrome developer for chrome Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise 9.3 Critical
- piriform ccleaner, ccleaner cloud +1 more CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise 9.3 Critical
- google tensorflow TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to... 6.5 Medium
-
@metamask/sdknpm,@metamask/sdk-communication-layernpm,@metamask/sdk-reactnpm +2 more MetaMask SDK indirectly exposed via malicious [email protected] dependency No score - Show olderLoading…