# supply_chain


- [CVE-2026-45321](https://insights.sbomify.com/CVE-2026-45321/): TanStack Unspecified (critical 9.6, exploited in the wild)
- [CVE-2026-33634](https://insights.sbomify.com/CVE-2026-33634/): Aquasecurity Trivy Embedded Malicious Code (critical 9.4, exploited in the wild)
- [CVE-2026-48027](https://insights.sbomify.com/CVE-2026-48027/): Nx Console Embedded Malicious Code (critical 9.3, exploited in the wild)
- [CVE-2026-8398](https://insights.sbomify.com/CVE-2026-8398/): Daemon Tools Lite Embedded Malicious Code (critical 9.3, exploited in the wild)
- [CVE-2025-59374](https://insights.sbomify.com/CVE-2025-59374/): ASUS Live Update Embedded Malicious Code (critical 9.3, exploited in the wild)
- [CVE-2024-4978](https://insights.sbomify.com/CVE-2024-4978/): Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code (high 8.7, exploited in the wild)
- [CVE-2025-30154](https://insights.sbomify.com/CVE-2025-30154/): reviewdog/action-setup GitHub Action Embedded Malicious Code (high 8.6, exploited in the wild)
- [CVE-2025-30066](https://insights.sbomify.com/CVE-2025-30066/): tj-actions/changed-files GitHub Action Embedded Malicious Code (high 8.6, exploited in the wild)
- [CVE-2026-3502](https://insights.sbomify.com/CVE-2026-3502/): TrueConf Client Download of Code Without Integrity Check (high 7.8, exploited in the wild)
- [CVE-2025-54313](https://insights.sbomify.com/CVE-2025-54313/): Prettier eslint-config-prettier Embedded Malicious Code (high 7.5, exploited in the wild)
- [CVE-2026-22306](https://insights.sbomify.com/CVE-2026-22306/): Critical flaw impacting OZOLS ERP's automatic update channel (critical 10.0)
- [CVE-2026-11976](https://insights.sbomify.com/CVE-2026-11976/): MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/types/supply-chain/