{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 25 to 31 May 2026 (week 22)","summary":"In the week of 25 to 31 May 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was TanStack (2), followed by Disc Soft Limited DAEMON Tools Lite (1) and Github-Actions (1).","url":"https://junglewise.ai/threats/exploited/2026-05-25","json_url":"https://junglewise.ai/threats/exploited/2026-05-25.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-05-25","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":5,"period":{"end":"2026-05-31","start":"2026-05-25"},"critical":5,"generated_at":"2026-10-02T20:07:00.213787+00:00","technologies":[{"hub":false,"name":"TanStack","slug":"tanstack","vulnerabilities":2},{"hub":false,"name":"Disc Soft Limited DAEMON Tools Lite","slug":"daemon-tools-lite","vulnerabilities":1},{"hub":false,"name":"Github-Actions","slug":"actions","vulnerabilities":1},{"hub":false,"name":"LiteSpeed Technologies cPanel Plugin","slug":"cpanel-plugin","vulnerabilities":1},{"hub":false,"name":"LiteSpeed Technologies User-End cPanel Plugin","slug":"user-end-cpanel-plugin","vulnerabilities":1},{"hub":false,"name":"Nrwl Nx-Console","slug":"nx-console","vulnerabilities":1},{"hub":false,"name":"Nx Console","slug":"console","vulnerabilities":1},{"hub":true,"name":"Palo Alto Networks Prisma Access","slug":"prisma-access","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/prisma-access"},{"hub":false,"name":"TanStack Arktype-Adapter","slug":"arktype-adapter","vulnerabilities":1},{"hub":false,"name":"TanStack ESLint Plugin Router","slug":"eslint-plugin-router","vulnerabilities":1},{"hub":false,"name":"TanStack History","slug":"history","vulnerabilities":1},{"hub":false,"name":"TanStack React Start","slug":"react-start","vulnerabilities":1},{"hub":true,"name":"TanStack React-Router","slug":"react-router","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/react-router"},{"hub":false,"name":"TanStack Router-Core","slug":"router-core","vulnerabilities":1},{"hub":false,"name":"TanStack Solid-Router","slug":"solid-router","vulnerabilities":1}],"vulnerabilities":[{"cve":"CVE-2026-0257","cvss":4.7,"epss":0.0007,"slug":"cve-2026-0257-palo-alto-networks-pan-os-auth-bypass-in-globalprotect","title":"Palo Alto Networks PAN-OS auth bypass in GlobalProtect","severity":"critical","exploited":true,"published_at":"2026-05-13T19:17:01.04+00:00","technologies":[{"hub":true,"name":"Palo Alto Networks Prisma Access","slug":"prisma-access","vendor":{"name":"Palo Alto Networks","slug":"palo-alto-networks"}}],"exploited_since":"2026-05-29T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-0257-palo-alto-networks-pan-os-auth-bypass-in-globalprotect"},{"cve":"CVE-2026-48027","cvss":9.3,"slug":"cve-2026-48027-nrwl-nx-console-malicious-code-injection-in-vscode-extension","title":"nrwl Nx Console Malicious Code Injection in VSCode Extension","severity":"critical","exploited":true,"published_at":"2026-05-27T17:16:41.787+00:00","technologies":[{"hub":false,"name":"Github-Actions","slug":"actions","vendor":{"name":"GitHub","slug":"github"}},{"hub":false,"name":"Nrwl Nx-Console","slug":"nx-console","vendor":{"name":"Nrwl","slug":"nrwl"}}],"exploited_since":"2026-05-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-48027-nrwl-nx-console-malicious-code-injection-in-vscode-extension"},{"cve":"CVE-2026-8398","cvss":9.8,"epss":0.0004,"slug":"cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise","title":"AVB Disc Soft DAEMON Tools Lite supply chain compromise","severity":"critical","exploited":true,"published_at":"2026-05-15T09:16:17.653+00:00","technologies":[{"hub":false,"name":"Nx Console","slug":"console","vendor":{"name":"Nx","slug":"nx"}},{"hub":false,"name":"Disc Soft Limited DAEMON Tools Lite","slug":"daemon-tools-lite","vendor":{"name":"Disc Soft Limited","slug":"disc-soft-limited"}},{"hub":false,"name":"TanStack","slug":"tanstack","vendor":{"name":"TanStack","slug":"tanstack"}}],"exploited_since":"2026-05-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise"},{"cve":"CVE-2026-45321","cvss":9.6,"epss":0.0105,"slug":"cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions","title":"TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking","severity":"critical","exploited":true,"published_at":"2026-05-12T01:16:46.82+00:00","technologies":[{"hub":false,"name":"TanStack Arktype-Adapter","slug":"arktype-adapter","vendor":{"name":"TanStack","slug":"tanstack"}},{"hub":false,"name":"TanStack ESLint Plugin Router","slug":"eslint-plugin-router","vendor":{"name":"TanStack","slug":"tanstack"}},{"hub":false,"name":"TanStack History","slug":"history","vendor":{"name":"TanStack","slug":"tanstack"}},{"hub":true,"name":"TanStack React-Router","slug":"react-router","vendor":{"name":"TanStack","slug":"tanstack"}},{"hub":false,"name":"TanStack React Start","slug":"react-start","vendor":{"name":"TanStack","slug":"tanstack"}},{"hub":false,"name":"TanStack Router-Core","slug":"router-core","vendor":{"name":"TanStack","slug":"tanstack"}}],"exploited_since":"2026-05-27T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions"},{"cve":"CVE-2026-48172","cvss":10,"epss":0.0001,"slug":"cve-2026-48172-litespeed-user-end-cpanel-plugin-privilege-escalation-to-root","title":"LiteSpeed User-End cPanel Plugin privilege escalation to root","severity":"critical","exploited":true,"published_at":"2026-05-21T02:16:33.76+00:00","technologies":[{"hub":false,"name":"LiteSpeed Technologies cPanel Plugin","slug":"cpanel-plugin","vendor":{"name":"LiteSpeed Technologies","slug":"litespeed-technologies"}},{"hub":false,"name":"LiteSpeed Technologies User-End cPanel Plugin","slug":"user-end-cpanel-plugin","vendor":{"name":"LiteSpeed Technologies","slug":"litespeed-technologies"}}],"exploited_since":"2026-05-26T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-48172-litespeed-user-end-cpanel-plugin-privilege-escalation-to-root"}],"previous":{"key":"2026-05-18","top":"Microsoft Defender","total":9,"period":{"end":"2026-05-24","start":"2026-05-18"},"critical":9,"url":"https://junglewise.ai/threats/exploited/2026-05-18"},"next":{"key":"2026-06-01","top":"Android Laravel Framework","total":6,"period":{"end":"2026-06-07","start":"2026-06-01"},"critical":6,"url":"https://junglewise.ai/threats/exploited/2026-06-01"}}