{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1195.002 Compromise Software Supply Chain","home_page_url":"https://patchfirst.co/technique/T1195.002/","feed_url":"https://patchfirst.co/feed/technique/T1195.002.json","description":"New and newly exploited CVEs that lead to ATT&CK T1195.002 Compromise Software Supply Chain, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-45321#kev","url":"https://patchfirst.co/cve/CVE-2026-45321/","title":"[KEV] CVE-2026-45321: TanStack Unspecified Vulnerability","content_text":"TanStack · TanStack. In CISA KEV since 2026-05-27, known ransomware use. ENISA EUVD lists it as exploited. EPSS 3.3% (higher than 88.4% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1528 Steal Application Access Token. Named in 1 threat report. Priority 86.3 of 100.","summary":"TanStack Unspecified Vulnerability","date_published":"2026-05-27T00:00:00.000Z","date_modified":"2026-10-26T18:10:00.000Z","tags":["kev","ransomware","public-exploit","T1195.002","T1528"],"_patchfirst":{"reason":"kev","priority":86.3,"kev":{"dateAdded":"2026-05-27","ransomware":true},"epss":{"score":0.03278,"percentile":0.88412},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"TanStack","product":"TanStack","techniqueIds":["T1195.002","T1528"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-48027#kev","url":"https://patchfirst.co/cve/CVE-2026-48027/","title":"[KEV] CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability","content_text":"Nx · Nx Console. In CISA KEV since 2026-05-27, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.8% (higher than 79.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 84.5 of 100.","summary":"Nx Console Embedded Malicious Code Vulnerability","date_published":"2026-05-27T00:00:00.000Z","date_modified":"2026-10-14T20:10:00.000Z","tags":["kev","ransomware","public-exploit","T1195.002","T1059"],"_patchfirst":{"reason":"kev","priority":84.5,"kev":{"dateAdded":"2026-05-27","ransomware":true},"epss":{"score":0.0185,"percentile":0.79087},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Nx","product":"Nx Console","techniqueIds":["T1195.002","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-8398#kev","url":"https://patchfirst.co/cve/CVE-2026-8398/","title":"[KEV] CVE-2026-8398: Daemon Tools Lite Embedded Malicious Code Vulnerability","content_text":"Daemon · Daemon Tools Lite. In CISA KEV since 2026-05-27. ENISA EUVD lists it as exploited. EPSS 1.5% (higher than 73.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1553.002 Code Signing. Priority 69.6 of 100.","summary":"Daemon Tools Lite Embedded Malicious Code Vulnerability","date_published":"2026-05-27T00:00:00.000Z","date_modified":"2026-10-26T14:10:00.000Z","tags":["kev","public-exploit","T1195.002","T1553.002"],"_patchfirst":{"reason":"kev","priority":69.6,"kev":{"dateAdded":"2026-05-27","ransomware":false},"epss":{"score":0.01456,"percentile":0.73466},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Daemon","product":"Daemon Tools Lite","techniqueIds":["T1195.002","T1553.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-33634#kev","url":"https://patchfirst.co/cve/CVE-2026-33634/","title":"[KEV] CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability","content_text":"Aquasecurity · Trivy. In CISA KEV since 2026-03-26. ENISA EUVD lists it as exploited. EPSS 59.7% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Named in 2 threat reports. Priority 80.1 of 100.","summary":"Aquasecurity Trivy Embedded Malicious Code Vulnerability","date_published":"2026-03-26T00:00:00.000Z","date_modified":"2026-06-17T10:37:49.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":80.1,"kev":{"dateAdded":"2026-03-26","ransomware":false},"epss":{"score":0.59727,"percentile":0.99127},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Aquasecurity","product":"Trivy","techniqueIds":["T1195.002","T1552.001"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-54313#kev","url":"https://patchfirst.co/cve/CVE-2025-54313/","title":"[KEV] CVE-2025-54313: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability","content_text":"Prettier · eslint-config-prettier. In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 5.1% (higher than 92.4% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1059 Command and Scripting Interpreter. Priority 66.7 of 100.","summary":"Prettier eslint-config-prettier Embedded Malicious Code Vulnerability","date_published":"2026-01-22T00:00:00.000Z","date_modified":"2026-06-17T09:39:49.000Z","tags":["kev","public-exploit","T1195.002","T1059"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2026-01-22","ransomware":false},"epss":{"score":0.05125,"percentile":0.92382},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Prettier","product":"eslint-config-prettier","techniqueIds":["T1195.002","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-59374#kev","url":"https://patchfirst.co/cve/CVE-2025-59374/","title":"[KEV] CVE-2025-59374: ASUS Live Update Embedded Malicious Code Vulnerability","content_text":"ASUS · Live Update. In CISA KEV since 2025-12-17. ENISA EUVD lists it as exploited. EPSS 1.2% (higher than 68.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1195.002 Compromise Software Supply Chain; T1059 Command and Scripting Interpreter. Priority 63.5 of 100.","summary":"ASUS Live Update Embedded Malicious Code Vulnerability","date_published":"2025-12-17T00:00:00.000Z","date_modified":"2026-09-25T23:10:00.000Z","tags":["kev","T1195.002","T1059"],"_patchfirst":{"reason":"kev","priority":63.5,"kev":{"dateAdded":"2025-12-17","ransomware":false},"epss":{"score":0.01197,"percentile":0.68074},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ASUS","product":"Live Update","techniqueIds":["T1195.002","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-30154#kev","url":"https://patchfirst.co/cve/CVE-2025-30154/","title":"[KEV] CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability","content_text":"reviewdog · action-setup GitHub Action. In CISA KEV since 2025-03-24. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.6% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 65.9 of 100.","summary":"reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability","date_published":"2025-03-24T00:00:00.000Z","date_modified":"2026-06-17T09:08:15.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":65.9,"kev":{"dateAdded":"2025-03-24","ransomware":false},"epss":{"score":0.02485,"percentile":0.84589},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"reviewdog","product":"action-setup GitHub Action","techniqueIds":["T1195.002","T1552.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-30066#kev","url":"https://patchfirst.co/cve/CVE-2025-30066/","title":"[KEV] CVE-2025-30066: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability","content_text":"tj-actions · changed-files GitHub Action. In CISA KEV since 2025-03-18. ENISA EUVD lists it as exploited. EPSS 72.1% (higher than 99.43% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 68.9 of 100.","summary":"tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability","date_published":"2025-03-18T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-03-18","ransomware":false},"epss":{"score":0.72092,"percentile":0.9943},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"tj-actions","product":"changed-files GitHub Action","techniqueIds":["T1195.002","T1552.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4978#kev","url":"https://patchfirst.co/cve/CVE-2024-4978/","title":"[KEV] CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","content_text":"Justice AV Solutions · Viewer . In CISA KEV since 2024-05-29. ENISA EUVD lists it as exploited. EPSS 26.9% (higher than 98% of CVEs). CVSS 8.4 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1105 Ingress Tool Transfer; T1005 Data from Local System; T1071.001 Web Protocols. Priority 68.5 of 100.","summary":"Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","date_published":"2024-05-29T00:00:00.000Z","date_modified":"2026-06-17T08:03:19.000Z","tags":["kev","public-exploit","T1195.002","T1105","T1005","T1071.001"],"_patchfirst":{"reason":"kev","priority":68.5,"kev":{"dateAdded":"2024-05-29","ransomware":false},"epss":{"score":0.26937,"percentile":0.98037},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1"},"vendor":"Justice AV Solutions","product":"Viewer ","techniqueIds":["T1195.002","T1105","T1005","T1071.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-44529#kev","url":"https://patchfirst.co/cve/CVE-2021-44529/","title":"[KEV] CVE-2021-44529: Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","content_text":"Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA). In CISA KEV since 2024-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.1% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain. Priority 79.8 of 100.","summary":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability","date_published":"2024-03-25T00:00:00.000Z","date_modified":"2026-08-04T05:16:27.000Z","tags":["kev","ransomware","public-exploit","T1190","T1195.002"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2024-03-25","ransomware":true},"epss":{"score":0.99105,"percentile":0.99933},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","techniqueIds":["T1190","T1195.002"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}