supply_chain vulnerabilities
supply_chain in numbers
sbomify tracks 1,280 supply_chain vulnerabilities. Most are found in library (82%), developer tool (8%) and desktop application (4%).
How to fix supply_chain vulnerabilities
Most exploited supply_chain vulnerabilities
- CVE-2026-45321 TanStack Unspecified
- CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code
- CVE-2026-48027 Nx Console Embedded Malicious Code
- CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code
- CVE-2025-59374 ASUS Live Update Embedded Malicious Code
- CVE-2024-4978 Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code
- CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code
- CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code
- CVE-2026-3502 TrueConf Client Download of Code Without Integrity Check
- CVE-2025-54313 Prettier eslint-config-prettier Embedded Malicious Code
- CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel
- CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise
Recently published
- CVE-2026-111862 Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
- CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm
- CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
- CVE-2026-110102 powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
- CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
- CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.