Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
CVE-2022-0492 is an improper authentication vulnerability in the Linux Kernel's cgroups v1 release_agent feature that can lead to privilege escalation. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.
CVE-2025-48595 is a high-severity elevation of privilege vulnerability in Google Android versions 14 through 16-qpr2. It arises from an integer overflow in multiple locations that can lead to code execution locally without requiring user interaction or additional privileges.
CVE-2026-34926 is a directory traversal vulnerability in the on-premise version of Trend Micro's TrendAI Apex One server. It allows a pre-authenticated local attacker with administrative credentials on the server to modify a key table, potentially injecting malicious code that could be deployed to agents. Exploitation requires prior administrative access to the Apex One server and is limited to the on-premise deployment. The vulnerability has a CVSS score of 6.7, indicating medium severity. No official patch or remediation information is currently available, and no known exploits are reported in the wild.
Langflow suffers from an origin validation error vulnerability due to an overly permissive CORS configuration combined with a refresh token cookie set as SameSite=None. This flaw allows malicious webpages to perform cross-origin requests with credentials, enabling calls to the refresh endpoint. Exploitation can lead to arbitrary code execution and full system compromise by leveraging obtained tokens that grant access to authenticated endpoints.
CVE-2024-21182 is a high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server.
Microsoft DirectX contains a vulnerability in the QuickTime Movie Parser Filter within quartz.dll in DirectShow that allows a NULL byte overwrite. This flaw can be exploited by remote attackers using a crafted QuickTime media file to execute arbitrary code. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
Adobe Acrobat and Reader have a heap-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by using a specially crafted PDF file. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2008-4250 is a buffer overflow vulnerability in the Windows Server Service of Microsoft Windows. It allows remote attackers to execute arbitrary code by sending a specially crafted RPC request that triggers an overflow during path canonicalization. This vulnerability has been exploited in the wild and is considered high severity.
Microsoft Internet Explorer contains a use-after-free vulnerability (CVE-2010-0249) that allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.
Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute arbitrary code by accessing an invalid pointer after an object has been deleted. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use. This vulnerability has been exploited in the wild.
CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. It allows attackers to bypass security restrictions and establish unauthorized VPN connections. Panorama and Cloud NGFW products are not affected. The vulnerability has a high severity with a CVSS score of 7.8. Exploits are known in the wild, and the vulnerability has been used in ransomware campaigns.
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
CVE-2026-42897 is a high-severity cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23. It involves improper neutralization of input during web page generation, allowing unauthorized attackers to perform spoofing attacks over a network. The vulnerability has a CVSS score of 8.1 and is known to be exploited in the wild. An official fix is available from Microsoft.