Skip to content
OpenAdvisories

Weakness (CWE)

CWE-506: Embedded Malicious Code

Class Incomplete

The product contains code that appears to be malicious in nature.

How to prevent it (1 mitigation)

  1. Implementation, Operation

    Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Source: MITRE CWE-506

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-74232 Exploited

    Zbtlink MQWrt yunmgrd Cloud C2 Implant

    Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmwar…

    Zbtlink MoreQuick WE826-T2 ZBT-ZBT7621
  • Critical 9.3
    CVE-2026-48027 Exploited · Ransomware

    Compromised Nx Console version 18.95.0

    Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, …

    nrwl nx-console
    KEV May 27, 2026
  • Critical 9.8
    CVE-2026-8398 Exploited

    A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421…

    AVB Disc Soft DAEMON Tools Lite
    KEV May 27, 2026
  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack solid-start vue-start react-start npm
    KEV May 27, 2026
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI Aqua Security team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 9.3
    CVE-2025-59374 Exploited

    "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifica…

    ASUS live update
    KEV Dec 17, 2025