Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 25 to 31 May 2026 (week 22)
Final report, published . It does not change.
In the week of 25 to 31 May 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was TanStack (2), followed by Disc Soft Limited DAEMON Tools Lite (1) and Github-Actions (1).
- Newly exploited
- 5
- Critical
- 5
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-0257: Palo Alto Networks PAN-OS auth bypass in GlobalProtectcriticalCVSS 4.7Exploited since Published Palo Alto Networks Prisma Access
- CVE-2026-48027: nrwl Nx Console Malicious Code Injection in VSCode ExtensioncriticalCVSS 9.3Exploited since Published Github-Actions, Nrwl Nx-Console
- CVE-2026-8398: AVB Disc Soft DAEMON Tools Lite supply chain compromisecriticalCVSS 9.8Exploited since Published Nx Console, Disc Soft Limited DAEMON Tools Lite, TanStack
- CVE-2026-45321: TanStack npm packages supply chain compromise via GitHub Actions OIDC hijackingcriticalCVSS 9.6Exploited since Published TanStack Arktype-Adapter, TanStack ESLint Plugin Router, TanStack History
- CVE-2026-48172: LiteSpeed User-End cPanel Plugin privilege escalation to rootcriticalCVSS 10Exploited since Published LiteSpeed Technologies cPanel Plugin, LiteSpeed Technologies User-End cPanel Plugin
Technologies hit most
- 1.TanStack2 vulnerabilities
- 2.Disc Soft Limited DAEMON Tools Lite1 vulnerability
- 3.Github-Actions1 vulnerability
- 4.LiteSpeed Technologies cPanel Plugin1 vulnerability
- 5.LiteSpeed Technologies User-End cPanel Plugin1 vulnerability
- 6.Nrwl Nx-Console1 vulnerability
- 7.Nx Console1 vulnerability
- 8.Palo Alto Networks Prisma Access1 vulnerability
- 9.TanStack Arktype-Adapter1 vulnerability
- 10.TanStack ESLint Plugin Router1 vulnerability
- 11.TanStack History1 vulnerability
- 12.TanStack React Start1 vulnerability
- 13.TanStack React-Router1 vulnerability
- 14.TanStack Router-Core1 vulnerability
- 15.TanStack Solid-Router1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-05-25.json, and this page as text at https://junglewise.ai/threats/exploited/2026-05-25.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 25 to 31 May 2026 (week 22)", https://junglewise.ai/threats/exploited/2026-05-25, 2 October 2026.