Skip to content
OpenAdvisories

Weakness (CWE)

CWE-506: Embedded Malicious Code

Class Incomplete

The product contains code that appears to be malicious in nature.

How to prevent it (1 mitigation)

  1. Implementation, Operation

    Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Source: MITRE CWE-506

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-66747 Public exploit

    ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant

    Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root un…

    Zbtlink WE5931 Firmware WE1026-5G-WD Firmware WG2107 Firmware
  • High 8.1
    CVE-2026-67595 Public exploit

    VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

    VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affecte…

    webreinvent vaahcms
  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack solid-start vue-start react-start npm
    KEV May 27, 2026
  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • Critical 9.6
    CVE-2025-10894 Public exploit

    Nx: nx/devkit: malicious versions of nx and plugins published to npm

    Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credent…

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Advanced Cluster Management for Kubernetes 2 OpenShift Serverless
  • High 7.5
    CVE-2025-54313 Exploited Public exploit

    eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

    prettier eslint-config-prettier eslint-plugin-prettier @pkgr/core npm
    KEV Jan 22, 2026
  • Critical 9.3
    CVE-2025-32965 Public exploit

    Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

    xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also…

    XRPLF xrpl.js xrpl npm
  • High 8.6
    CVE-2025-30066 Exploited Public exploit EPSS 72%

    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…

    tj-actions changed-files tj-actions/changed-files GitHub Actions
    KEV Mar 18, 2025
  • Critical 10.0
    CVE-2024-3094 Public exploit EPSS 91%

    Xz: malicious code in distributed source

    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is the…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • Critical 9.8
    CVE-2022-23812 Public exploit

    Malicious Package

    This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…

    node-ipc npm