260702
ic3.gov · Undated · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2025-55182Meta React Server Components Remote Code Execution VulnerabilityMeta · React Server ComponentsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter5 reports99.8%Top 0.04%95.0priority
- CVE-2026-45321TanStack Unspecified VulnerabilityTanStack · TanStackKEVRansomwarePublic exploitCritical · 9.6T1195.002Compromise Software Supply ChainT1528Steal Application Access Token1 report3.3%Top 12%86.3priority
- CVE-2026-48027Nx Console Embedded Malicious Code VulnerabilityNx · Nx ConsoleKEVRansomwarePublic exploitCritical · 9.8T1195.002Compromise Software Supply ChainT1059Command and Scripting Interpreter1 report1.8%Top 21%84.5priority
- CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code VulnerabilityAquasecurity · TrivyKEVPublic exploitHigh · 8.8T1195.002Compromise Software Supply ChainT1552.001Credentials In Files2 reports59.7%Top 0.87%80.1priority
Where it names them
CVE-2025-55182 Original (opens in a new tab) ↗
CVE-2026-45321 CVE-2025-55182
CVE-2026-45321 Original (opens in a new tab) ↗
CVE-2026-45321 CVE-2025-55182
CVE-2026-48027 Original (opens in a new tab) ↗
CVE-2026-33634 CVE-2026-48027
CVE-2026-33634 Original (opens in a new tab) ↗
CVE-2026-33634 CVE-2026-48027
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.