CWE-1104 · Supply Chain and Malicious Code
Use of Unmaintained Third Party Components
29CVEs
0exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
29 CVEs with CWE-1104 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-7102Remote Code Execution (RCE) VulnerabilityBarracuda Networks Inc. · Barracuda ESG Appliance · 2023-12-24 | – | 45% | 2023-12-24 |
| CVE-2024-35252Azure Storage Movement Client Library Denial of Service VulnerabilityMicrosoft · Azure Storage · CVSS 7.5 · 2024-06-11 | 7.5 | 2.5% | 2024-06-11 |
| CVE-2021-22142Kibana Reporting vulnerabilitiesElastic · Kibana · CVSS 6.6 · 2023-11-22 | 6.6 | 1.0% | 2023-11-22 |
| CVE-2022-46871An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108.Mozilla · Firefox · CVSS 8.8 · 2022-12-22 | 8.8 | 1.0% | 2022-12-22 |
| CVE-2025-34192Vasion Print (formerly PrinterLogic) Usage of Outdated and Unsupported OpenSSL VersionVasion · Print Virtual Appliance Host · CVSS 9.3 · 2025-09-19 | 9.3 | 1.0% | 2025-09-19 |
| CVE-2026-16634TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99FELIPE · TOML::XS · CVSS 9.8 · 2026-07-24 | 9.8 | 0.8% | 2026-07-24 |
| CVE-2025-10220Outdated Third-Party NuGet Packages in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4AxxonSoft · AxxonOne C-Werk · CVSS 9.8 · 2025-09-10 | 9.8 | 0.7% | 2025-09-10 |
| CVE-2026-3031Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg libraryTOKUHIROM · Image::EPEG · CVSS 9.8 · 2026-07-16 | 9.8 | 0.7% | 2026-07-16 |
| CVE-2026-66788Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker labelRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.16 · CVSS 9.9 · 2026-08-20 | 9.9 | 0.7% | 2026-08-20 |
| CVE-2024-11999CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into H…Schneider Electric · Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with… · CVSS 8.8 · 2024-12-17 | 8.8 | 0.6% | 2024-12-17 |
| CVE-2026-60368Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.…Oracle Corporation · Oracle Platform Security for Java · CVSS 8.8 · 2026-07-22 | 8.8 | 0.5% | 2026-07-22 |
| CVE-2022-36937HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is depr…Facebook · HHVM · CVSS 9.8 · 2023-05-10 | 9.8 | 0.5% | 2023-05-10 |
| CVE-2026-21752HCL Hive is affected by a use of vulnerable third-party componentsHCLSoftware · HCL Hive · CVSS 7.5 · 2026-08-24 | 7.5 | 0.4% | 2026-08-24 |
| CVE-2025-12104Incorrect Content-Type HeaderAzure Access Technology · BLU-IC2 · CVSS 10 · 2025-10-23 | 10.0 | 0.4% | 2025-10-23 |
| CVE-2025-3497Radiflow iSAP Smart Collector Linux distribution unmaintainedRadiflow · iSAP Smart Collector · CVSS 8.7 · 2025-07-09 | 8.7 | 0.4% | 2025-07-09 |
| CVE-2026-41468Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template InjectionBeghelli · SicuroWeb (Sicuro24) · CVSS 8.7 · 2026-04-22 | 8.7 | 0.4% | 2026-04-22 |
| CVE-2026-82935Use of End-of-Life components in mH-DEVELOPERF&F Filipowski · mH-DEVELOPER · CVSS 6.9 · 2026-09-28 | 6.9 | 0.4% | 2026-09-28 |
| CVE-2026-12554HP Easy Start for macOS - Security UpdateHP Inc · HP Easy Start for macOS · CVSS 8.5 · 2026-08-24 | 8.5 | 0.3% | 2026-08-24 |
| CVE-2026-56580HCL MyCloud was affected by Using Components with Known VulnerabilityHCLSoftware · MyCloud · CVSS 2.2 · 2026-07-21 | 2.2 | 0.3% | 2026-07-21 |
| CVE-2023-37524HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of serviceHCLSoftware · Traveler for Microsoft Outlook · CVSS 7.7 · 2026-06-27 | 7.7 | 0.3% | 2026-06-27 |
| CVE-2025-20010Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of pri…Intel(R) Processor Identification Utility · CVSS 7.8 · 2025-11-11 | 7.8 | 0.3% | 2025-11-11 |
| CVE-2025-36745SolarEdge SE3680H contains Linux Kernel vulnerabilitiesSolarEdge · SE3680H · CVSS 8.6 · 2025-12-12 | 8.6 | 0.2% | 2025-12-12 |
| CVE-2026-21753HCL Hive is affected by multiple security vulnerabilities.HCL Software · Hive · CVSS 4.2 · 2026-08-25 | 4.2 | 0.2% | 2026-08-25 |
| CVE-2026-21821HCL BigFix SCM Reporting is affected by vulnerabilities in jQueryHCLSoftware · BigFix SCM Reporting · CVSS 8.3 · 2026-05-13 | 8.3 | 0.2% | 2026-05-13 |
| CVE-2025-14026Vulnerable Python version used in Forcepoint One DLP ClientForcepoint · Forcepoint One Endpoint (F1E) · CVSS 7.8 · 2026-01-06 | 7.8 | 0.2% | 2026-01-06 |
| CVE-2025-52658HCL MyXalytics is affected by the use of vulnerable/outdated versionsHCL Software · MyXalytics · CVSS 3.5 · 2025-10-03 | 3.5 | 0.2% | 2025-10-03 |
| CVE-2025-55277HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerabilityHCL · Aftermarket DPC · CVSS 2.6 · 2026-03-26 | 2.6 | 0.2% | 2026-03-26 |
| CVE-2025-48862Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the p…Bosch Rexroth AG · ctrlX OS - Setup · CVSS 7.1 · 2025-08-14 | 7.1 | 0.1% | 2025-08-14 |
| CVE-2024-8885A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.Sophos · Sophos Intercept X · CVSS 8.8 · 2024-10-02 | 8.8 | 0.1% | 2024-10-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.