Topics /
Supply chain
Packages, CI/CD and dev tools compromised and spread through dependencies
| Vulnerability · | KEV | |||
|---|---|---|---|---|
CVE-2026-86063 Claude Code plugin commit SHA pin bypass | High | 7.5 | Not listed | — |
CVE-2026-109560 Continue CLI Bash permission rule bypass | High | 7.7 | Not listed | — |
No CVEMAL-2026-11524 keyv / cacheable npm packages hijacked | N/A | — | Not listed | 2026-08-04 |
CVE-2026-114090 Trigger.dev CLI dev MCP server missing authentication | High | 7.6 | Not listed | — |
CVE-2026-90553 vLLM LlavaOnevision2 ignores trust_remote_code | High | 7.8 | Not listed | 2026-07-11 |
CVE-2026-82021 Hermes Agent MCP catalog not pinned to a commit | Critical | 9.0 | Not listed | 2026-07-07 |
CVE-2026-50016 pnpm dependency alias path traversal | High | 8.8 | Not listed | — |
CVE-2026-48501 GitHub CLI verify commands leak token | Critical | 9.1 | Not listed | — |
CVE-2026-48027 Nx Console malicious extension update | Critical | 9.8 | Listed | 2026-05-18 |
CVE-2026-45321 TanStack npm release pipeline hijack | Critical | 9.6 | Listed | 2026-05-11 |
CVE-2026-45758 guardrails-ai malicious PyPI release | Critical | 9.6 | Not listed | 2026-05-11 |
CVE-2026-46421 SAP @cap-js / mbt malicious npm releases | Critical | 9.3 | Not listed | 2026-04-29 |
No CVEGHSA-fw8c-xr5c-95f9 axios npm maintainer account takeover | N/A | — | Not listed | 2026-03-31 |
CVE-2026-33634 Trivy and trivy-action trojanized | High | 8.8 | Listed | 2026-03-19 |
No CVEMAL-2025-190925 PostHog npm publish token stolen | N/A | — | Not listed | 2025-11-24 |
CVE-2026-5241 Transformers LightGlue config overrides trust_remote_code | Critical | 9.6 | Not listed | 2025-07-25 |
CVE-2026-12537 Gemini CLI headless workspace trust | High | 7.8 | Not listed | 2025-06-25 |
Nothing we have published matches these conditions (that does not mean the product has no vulnerabilities).