CWE-1395 · Supply Chain and Malicious Code
Dependency on Vulnerable Third-Party Component
52CVEs
0exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
52 CVEs with CWE-1395 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-5246NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution VulnerabilityNETGEAR · ProSAFE Network Management System · CVSS 8.8 · 2024-05-23 | 8.8 | 31% | 2024-05-23 |
| CVE-2024-38526pdoc embeds link to malicious CDN if math mode is enabledmitmproxy · pdoc · CVSS 0 · 2024-06-25 | 0.0 | 3.8% | 2024-06-25 |
| CVE-2024-21421Azure SDK Spoofing VulnerabilityMicrosoft · Azure SDK · CVSS 7.5 · 2024-03-12 | 7.5 | 1.8% | 2024-03-12 |
| CVE-2024-11948GFI Archiver Telerik Web UI Remote Code Execution VulnerabilityGFI · Archiver · CVSS 9.8 · 2024-12-11 | 9.8 | 1.4% | 2024-12-11 |
| CVE-2024-0552Intumit inc. SmartRobot - Remote Code ExecutionIntumit inc. · SmartRobot · CVSS 9.8 · 2024-01-15 | 9.8 | 1.2% | 2024-01-15 |
| CVE-2026-23654GitHub: Zero Shot SCFoundation Remote Code Execution VulnerabilityMicrosoft · GitHub Repo: Zero Shot scFoundation · CVSS 8.8 · 2026-03-10 | 8.8 | 1.0% | 2026-03-10 |
| CVE-2025-34203Vasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party ComponentsVasion · Print Virtual Appliance Host · CVSS 9.3 · 2025-09-19 | 9.3 | 0.9% | 2025-09-19 |
| CVE-2023-5332Dependency on Vulnerable Third-Party Component in GitLabGitLab · GitLab · CVSS 5.9 · 2023-12-04 | 5.9 | 0.9% | 2023-12-04 |
| CVE-2026-128027FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixesphp · frankenphp · CVSS 9.8 · 2026-11-13 | 9.8 | 0.8% | 2026-11-13 |
| CVE-2026-4176Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::ZlibSHAY · perl · CVSS 9.8 · 2026-03-29 | 9.8 | 0.7% | 2026-03-29 |
| CVE-2025-40907FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) libraryETHER · FCGI · CVSS 5.3 · 2025-05-16 | 5.3 | 0.7% | 2025-05-16 |
| CVE-2020-36846IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C libraryTIMLEGGE · IO::Compress::Brotli · CVSS 9.8 · 2025-05-30 | 9.8 | 0.7% | 2025-05-30 |
| CVE-2026-58586Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebpZAPAD · Image::WebP · CVSS 9.8 · 2026-07-24 | 9.8 | 0.6% | 2026-07-24 |
| CVE-2025-40906BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilitiesMONGODB · BSON::XS · CVSS 9.8 · 2025-05-16 | 9.8 | 0.6% | 2025-05-16 |
| CVE-2025-10226PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple VulnerabilitiesAxxonSoft · AxxonOne C-Werk · CVSS 9.8 · 2025-09-10 | 9.8 | 0.6% | 2025-09-10 |
| CVE-2026-3381Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlibPMQS · Compress::Raw::Zlib · CVSS 9.8 · 2026-03-05 | 9.8 | 0.6% | 2026-03-05 |
| CVE-2026-34654Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe · Adobe Commerce · CVSS 5.3 · 2026-05-12 | 5.3 | 0.6% | 2026-05-12 |
| CVE-2026-115946XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoderXS-libbrotli · CVSS 9.8 · 2026-10-31 | 9.8 | 0.6% | 2026-10-31 |
| CVE-2025-15638Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcryptATRODO · Net::Dropbear · CVSS 10 · 2026-04-21 | 10.0 | 0.6% | 2026-04-21 |
| CVE-2025-40914Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflowMIK · CryptX · CVSS 9.8 · 2025-06-11 | 9.8 | 0.6% | 2025-06-11 |
| CVE-2026-34652Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe · Adobe Commerce · CVSS 7.5 · 2026-05-12 | 7.5 | 0.5% | 2026-05-12 |
| CVE-2026-126384n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Noden8n-io · n8n · CVSS 7.5 · 2026-11-13 | 7.5 | 0.5% | 2026-11-13 |
| CVE-2026-0943HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerabilityJV · HarfBuzz::Shaper · CVSS 7.5 · 2026-01-19 | 7.5 | 0.5% | 2026-01-19 |
| CVE-2026-3257UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite libraryTOKUHIROM · UnQLite · CVSS 9.8 · 2026-03-05 | 9.8 | 0.5% | 2026-03-05 |
| CVE-2026-60455Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.…Oracle Corporation · Oracle Platform Security for Java · CVSS 8.8 · 2026-07-22 | 8.8 | 0.4% | 2026-07-22 |
| CVE-2025-40912CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicodeMIK · CryptX · CVSS 9.8 · 2025-06-11 | 9.8 | 0.4% | 2025-06-11 |
| CVE-2022-4976Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilitiesETJ · Archive::Unzip::Burst · CVSS 9.8 · 2025-06-12 | 9.8 | 0.4% | 2025-06-12 |
| CVE-2025-43867- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifyin…Johnson Controls · FX Server · CVSS 8.5 · 2026-11-13 | 8.5 | 0.4% | 2026-11-13 |
| CVE-2024-26293Unauthenticated Path Traversal affecting Avid NEXISAvid · Avid NEXIS E-series · CVSS 8.7 · 2025-07-14 | 8.7 | 0.4% | 2025-07-14 |
| CVE-2026-100242DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)Wikimedia Foundation · Mediawiki - DataTransfer Extension · CVSS 7.5 · 2026-09-29 | 7.5 | 0.4% | 2026-09-29 |
| CVE-2024-32753TYCO Illustra Pro Gen 4 - JQuery versionJohnson Controls · TYCO Illustra Pro4 Fixed cameras · CVSS 7 · 2024-07-11 | 7.0 | 0.4% | 2024-07-11 |
| CVE-2025-12220Busybox 1.31.1 - Multiple Known VulnerabilitiesAzure Access Technology · BLU-IC2 · CVSS 10 · 2025-10-25 | 10.0 | 0.4% | 2025-10-25 |
| CVE-2025-12219Vulnerable Components in Azure Access OSAzure Access Technology · BLU-IC2 · CVSS 10 · 2025-10-25 | 10.0 | 0.4% | 2025-10-25 |
| CVE-2024-14031Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard libraryYVES · Sereal::Encoder · CVSS 8.1 · 2026-03-31 | 8.1 | 0.4% | 2026-03-31 |
| CVE-2024-14030Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard libraryYVES · Sereal::Decoder · CVSS 8.1 · 2026-03-31 | 8.1 | 0.4% | 2026-03-31 |
| CVE-2026-69713Windows Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 4.4 · 2026-09-08 | 4.4 | 0.4% | 2026-09-08 |
| CVE-2025-11159Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party ComponentHitachi Vantara · Pentaho Data Integration and Analytics · CVSS 9.1 · 2026-05-13 | 9.1 | 0.3% | 2026-05-13 |
| CVE-2025-40913Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflowATRODO · Net::Dropbear · CVSS 6.5 · 2025-07-16 | 6.5 | 0.3% | 2025-07-16 |
| CVE-2026-58235Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)SAP_SE · SAP NetWeaver AS Java (Adobe Document Services) · CVSS 6.3 · 2026-08-11 | 6.3 | 0.3% | 2026-08-11 |
| CVE-2022-4988Alien::FreeImage versions through 1.001 for Perl contains several vulnerable librariesKMX · Alien::FreeImage · CVSS 7.3 · 2026-05-11 | 7.3 | 0.3% | 2026-05-11 |
| CVE-2024-6121NI SystemLink Server Ships Out of Date Redis VersionNI · SystemLink Server · CVSS 7.8 · 2024-07-22 | 7.8 | 0.3% | 2024-07-22 |
| CVE-2025-15444Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodiumIAMB · Crypt::Sodium::XS · CVSS 9.8 · 2026-01-06 | 9.8 | 0.3% | 2026-01-06 |
| CVE-2025-59851HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerabilityHCL · DFXAnalytics · CVSS 3.7 · 2026-05-06 | 3.7 | 0.2% | 2026-05-06 |
| CVE-2026-90455Dependency on vulnerable third-party component in MalcolmCISA · Malcolm · CVSS 3.7 · 2026-09-11 | 3.7 | 0.2% | 2026-09-11 |
| CVE-2025-13823Micro820®, Micro850®, Micro870® – Specialized Fuzzing VulnerabilitiesRockwell Automation · Micro820®, Micro850®, Micro870® · CVSS 7.1 · 2025-12-15 | 7.1 | 0.2% | 2025-12-15 |
| CVE-2024-12740Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision SoftwareNI · Vision Development Module · CVSS 7.8 · 2025-01-27 | 7.8 | 0.2% | 2025-01-27 |
| CVE-2025-31973HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'HCL · BigFix Service Management (SM) · CVSS 4 · 2026-05-20 | 4.0 | 0.2% | 2026-05-20 |
| CVE-2026-47906Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe · Dreamweaver Desktop · CVSS 8.6 · 2026-06-09 | 8.6 | 0.2% | 2026-06-09 |
| CVE-2024-42206HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application.HCL · iReflection · CVSS 3.1 · 2026-06-02 | 3.1 | 0.2% | 2026-06-02 |
| CVE-2025-69275Spectrum outdated java library in class-pathBroadcom · DX NetOps Spectrum · CVSS 7.1 · 2026-01-12 | 7.1 | 0.1% | 2026-01-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.