{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1552.001 Credentials In Files","home_page_url":"https://patchfirst.co/technique/T1552.001/","feed_url":"https://patchfirst.co/feed/technique/T1552.001.json","description":"New and newly exploited CVEs that lead to ATT&CK T1552.001 Credentials In Files, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-33634#kev","url":"https://patchfirst.co/cve/CVE-2026-33634/","title":"[KEV] CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability","content_text":"Aquasecurity · Trivy. In CISA KEV since 2026-03-26. ENISA EUVD lists it as exploited. EPSS 59.7% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Named in 2 threat reports. Priority 80.1 of 100.","summary":"Aquasecurity Trivy Embedded Malicious Code Vulnerability","date_published":"2026-03-26T00:00:00.000Z","date_modified":"2026-06-17T10:37:49.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":80.1,"kev":{"dateAdded":"2026-03-26","ransomware":false},"epss":{"score":0.59727,"percentile":0.99127},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Aquasecurity","product":"Trivy","techniqueIds":["T1195.002","T1552.001"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-30154#kev","url":"https://patchfirst.co/cve/CVE-2025-30154/","title":"[KEV] CVE-2025-30154: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability","content_text":"reviewdog · action-setup GitHub Action. In CISA KEV since 2025-03-24. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.6% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 65.9 of 100.","summary":"reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability","date_published":"2025-03-24T00:00:00.000Z","date_modified":"2026-06-17T09:08:15.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":65.9,"kev":{"dateAdded":"2025-03-24","ransomware":false},"epss":{"score":0.02485,"percentile":0.84589},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"reviewdog","product":"action-setup GitHub Action","techniqueIds":["T1195.002","T1552.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-30066#kev","url":"https://patchfirst.co/cve/CVE-2025-30066/","title":"[KEV] CVE-2025-30066: tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability","content_text":"tj-actions · changed-files GitHub Action. In CISA KEV since 2025-03-18. ENISA EUVD lists it as exploited. EPSS 72.1% (higher than 99.43% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 68.9 of 100.","summary":"tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability","date_published":"2025-03-18T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1195.002","T1552.001"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2025-03-18","ransomware":false},"epss":{"score":0.72092,"percentile":0.9943},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"tj-actions","product":"changed-files GitHub Action","techniqueIds":["T1195.002","T1552.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-57727#kev","url":"https://patchfirst.co/cve/CVE-2024-57727/","title":"[KEV] CVE-2024-57727: SimpleHelp Path Traversal Vulnerability","content_text":"SimpleHelp  · SimpleHelp. In CISA KEV since 2025-02-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.8% (higher than 99.89% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1003 OS Credential Dumping; T1552.001 Credentials In Files; T1552.004 Private Keys; T1059 Command and Scripting Interpreter. Priority 78.2 of 100.","summary":"SimpleHelp Path Traversal Vulnerability","date_published":"2025-02-13T00:00:00.000Z","date_modified":"2026-08-04T05:16:31.000Z","tags":["kev","ransomware","public-exploit","T1190","T1003","T1552.001","T1552.004","T1059"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2025-02-13","ransomware":true},"epss":{"score":0.96833,"percentile":0.99887},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SimpleHelp ","product":"SimpleHelp","techniqueIds":["T1190","T1003","T1552.001","T1552.004","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-26138#kev","url":"https://patchfirst.co/cve/CVE-2022-26138/","title":"[KEV] CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","content_text":"Atlassian · Confluence. In CISA KEV since 2022-07-29. ENISA EUVD lists it as exploited. EPSS 98.2% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552.001 Credentials In Files. Named in 1 threat report. Priority 83.7 of 100.","summary":"Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability","date_published":"2022-07-29T00:00:00.000Z","date_modified":"2026-06-17T04:34:46.000Z","tags":["kev","public-exploit","T1552.001"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2022-07-29","ransomware":false},"epss":{"score":0.98241,"percentile":0.99916},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Atlassian","product":"Confluence","techniqueIds":["T1552.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11510#kev","url":"https://patchfirst.co/cve/CVE-2019-11510/","title":"[KEV] CVE-2019-11510: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","content_text":"Ivanti · Pulse Connect Secure. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery; T1552.001 Credentials In Files. Named in 6 threat reports. Priority 90.0 of 100.","summary":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:13:04.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083","T1552.001"],"_patchfirst":{"reason":"kev","priority":90,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99995},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Ivanti","product":"Pulse Connect Secure","techniqueIds":["T1133","T1059","T1083","T1552.001"],"reportCount":6,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3240","url":"https://patchfirst.co/cve/CVE-2020-3240/","title":"CVE-2020-3240: Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","content_text":"Cisco · Cisco UCS Director. Not in CISA KEV. EPSS 38.7% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1005 Data from Local System; T1505.003 Web Shell; T1003.008 /etc/passwd and /etc/shadow; T1059 Command and Scripting Interpreter; T1552.001 Credentials In Files. Priority 26.6 of 100.","summary":"Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data","date_published":"2020-04-15T00:00:00.000Z","date_modified":"2024-11-15T17:30:58.000Z","tags":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"_patchfirst":{"reason":"published","priority":26.6,"kev":null,"epss":{"score":0.38693,"percentile":0.98578},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"Cisco","product":"Cisco UCS Director","techniqueIds":["T1133","T1005","T1505.003","T1003.008","T1059","T1552.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3780","url":"https://patchfirst.co/cve/CVE-2019-3780/","title":"CVE-2019-3780: Cloud Foundry Container Runtime Leaks IAAS Credentials","content_text":"Cloud Foundry · Cloud Foundry Container Runtime (CFCR). Not in CISA KEV. EPSS 1.4% (higher than 73% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1552.001 Credentials In Files; T1068 Exploitation for Privilege Escalation. Priority 21.0 of 100.","summary":"Cloud Foundry Container Runtime Leaks IAAS Credentials","date_published":"2019-03-08T00:00:00.000Z","date_modified":"2024-09-16T22:45:16.000Z","tags":["T1552.001","T1068"],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.01429,"percentile":0.72977},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0"},"vendor":"Cloud Foundry","product":"Cloud Foundry Container Runtime (CFCR)","techniqueIds":["T1552.001","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3782","url":"https://patchfirst.co/cve/CVE-2019-3782/","title":"CVE-2019-3782: CredHub CLI writes environment variable credentials to disk","content_text":"Cloud Foundry · CredHub CLI. Not in CISA KEV. EPSS 0.4% (higher than 29.4% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1552.001 Credentials In Files; T1098 Account Manipulation. Priority 10.3 of 100.","summary":"CredHub CLI writes environment variable credentials to disk","date_published":"2019-02-13T00:00:00.000Z","date_modified":"2024-09-16T23:36:58.000Z","tags":["T1552.001","T1098"],"_patchfirst":{"reason":"published","priority":10.3,"kev":null,"epss":{"score":0.00357,"percentile":0.29435},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cloud Foundry","product":"CredHub CLI","techniqueIds":["T1552.001","T1098"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-7520","url":"https://patchfirst.co/cve/CVE-2018-7520/","title":"CVE-2018-7520: An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline…","content_text":"Geutebrück · Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware. Not in CISA KEV. EPSS 1.6% (higher than 75.3% of CVEs). ATT&CK: T1552.001 Credentials In Files. Priority 15.1 of 100.","summary":"An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline…","date_published":"2018-03-22T00:00:00.000Z","date_modified":"2024-09-17T03:27:26.000Z","tags":["T1552.001"],"_patchfirst":{"reason":"published","priority":15.1,"kev":null,"epss":{"score":0.01566,"percentile":0.75284},"cvss":null,"vendor":"Geutebrück","product":"Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware","techniqueIds":["T1552.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}