https://patchfirst.co/technique/T1552.001/New and newly exploited CVEs that lead to ATT&CK T1552.001 Credentials In Files, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2026-33634/CVE-2026-33634#kevThu, 26 Mar 2026 00:00:00 GMTAquasecurity · Trivy. In CISA KEV since 2026-03-26. ENISA EUVD lists it as exploited. EPSS 59.7% (higher than 99.13% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Named in 2 threat reports. Priority 80.1 of 100.kevpublic-exploitT1195.002T1552.001https://patchfirst.co/cve/CVE-2025-30154/CVE-2025-30154#kevMon, 24 Mar 2025 00:00:00 GMTreviewdog · action-setup GitHub Action. In CISA KEV since 2025-03-24. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.6% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 65.9 of 100.kevpublic-exploitT1195.002T1552.001https://patchfirst.co/cve/CVE-2025-30066/CVE-2025-30066#kevTue, 18 Mar 2025 00:00:00 GMTtj-actions · changed-files GitHub Action. In CISA KEV since 2025-03-18. ENISA EUVD lists it as exploited. EPSS 72.1% (higher than 99.43% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1195.002 Compromise Software Supply Chain; T1552.001 Credentials In Files. Priority 68.9 of 100.kevpublic-exploitT1195.002T1552.001https://patchfirst.co/cve/CVE-2024-57727/CVE-2024-57727#kevThu, 13 Feb 2025 00:00:00 GMTSimpleHelp · SimpleHelp. In CISA KEV since 2025-02-13, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.8% (higher than 99.89% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1003 OS Credential Dumping; T1552.001 Credentials In Files; T1552.004 Private Keys; T1059 Command and Scripting Interpreter. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1003T1552.001T1552.004T1059https://patchfirst.co/cve/CVE-2022-26138/CVE-2022-26138#kevFri, 29 Jul 2022 00:00:00 GMTAtlassian · Confluence. In CISA KEV since 2022-07-29. ENISA EUVD lists it as exploited. EPSS 98.2% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1552.001 Credentials In Files. Named in 1 threat report. Priority 83.7 of 100.kevpublic-exploitT1552.001https://patchfirst.co/cve/CVE-2019-11510/CVE-2019-11510#kevWed, 03 Nov 2021 00:00:00 GMTIvanti · Pulse Connect Secure. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery; T1552.001 Credentials In Files. Named in 6 threat reports. Priority 90.0 of 100.kevransomwarepublic-exploitT1133T1059T1083T1552.001https://patchfirst.co/cve/CVE-2020-3240/CVE-2020-3240Wed, 15 Apr 2020 00:00:00 GMTCisco · Cisco UCS Director. Not in CISA KEV. EPSS 38.7% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1005 Data from Local System; T1505.003 Web Shell; T1003.008 /etc/passwd and /etc/shadow; T1059 Command and Scripting Interpreter; T1552.001 Credentials In Files. Priority 26.6 of 100.T1133T1005T1505.003T1003.008T1059T1552.001https://patchfirst.co/cve/CVE-2019-3780/CVE-2019-3780Fri, 08 Mar 2019 00:00:00 GMTCloud Foundry · Cloud Foundry Container Runtime (CFCR). Not in CISA KEV. EPSS 1.4% (higher than 73% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1552.001 Credentials In Files; T1068 Exploitation for Privilege Escalation. Priority 21.0 of 100.T1552.001T1068https://patchfirst.co/cve/CVE-2019-3782/CVE-2019-3782Wed, 13 Feb 2019 00:00:00 GMTCloud Foundry · CredHub CLI. Not in CISA KEV. EPSS 0.4% (higher than 29.4% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1552.001 Credentials In Files; T1098 Account Manipulation. Priority 10.3 of 100.T1552.001T1098https://patchfirst.co/cve/CVE-2018-7520/CVE-2018-7520Thu, 22 Mar 2018 00:00:00 GMTGeutebrück · Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware. Not in CISA KEV. EPSS 1.6% (higher than 75.3% of CVEs). ATT&CK: T1552.001 Credentials In Files. Priority 15.1 of 100.T1552.001