# Newly exploited vulnerabilities: week of 25 to 31 May 2026 (week 22)

Source: https://junglewise.ai/threats/exploited/2026-05-25  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-05-25.json  
License: CC BY 4.0 with a link back

In the week of 25 to 31 May 2026, 5 vulnerabilities were newly recorded as exploited in the wild, 5 of them critical. The technology hit most was TanStack (2), followed by Disc Soft Limited DAEMON Tools Lite (1) and Github-Actions (1).

## Newly exploited this week

- [CVE-2026-0257: Palo Alto Networks PAN-OS auth bypass in GlobalProtect](https://junglewise.ai/threats/cve-2026-0257-palo-alto-networks-pan-os-auth-bypass-in-globalprotect) (critical, exploited in the wild, CVSS 4.7, exploited since 29 May 2026, published 13 May 2026)
- [CVE-2026-48027: nrwl Nx Console Malicious Code Injection in VSCode Extension](https://junglewise.ai/threats/cve-2026-48027-nrwl-nx-console-malicious-code-injection-in-vscode-extension) (critical, exploited in the wild, CVSS 9.3, exploited since 27 May 2026, published 27 May 2026)
- [CVE-2026-8398: AVB Disc Soft DAEMON Tools Lite supply chain compromise](https://junglewise.ai/threats/cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise) (critical, exploited in the wild, CVSS 9.8, exploited since 27 May 2026, published 15 May 2026)
- [CVE-2026-45321: TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking](https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions) (critical, exploited in the wild, CVSS 9.6, exploited since 27 May 2026, published 12 May 2026)
- [CVE-2026-48172: LiteSpeed User-End cPanel Plugin privilege escalation to root](https://junglewise.ai/threats/cve-2026-48172-litespeed-user-end-cpanel-plugin-privilege-escalation-to-root) (critical, exploited in the wild, CVSS 10, exploited since 26 May 2026, published 21 May 2026)

## Technologies hit most

1. TanStack: 2 vulnerabilities
2. Disc Soft Limited DAEMON Tools Lite: 1 vulnerability
3. Github-Actions: 1 vulnerability
4. LiteSpeed Technologies cPanel Plugin: 1 vulnerability
5. LiteSpeed Technologies User-End cPanel Plugin: 1 vulnerability
6. Nrwl Nx-Console: 1 vulnerability
7. Nx Console: 1 vulnerability
8. [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access): 1 vulnerability
9. TanStack Arktype-Adapter: 1 vulnerability
10. TanStack ESLint Plugin Router: 1 vulnerability
11. TanStack History: 1 vulnerability
12. TanStack React Start: 1 vulnerability
13. [TanStack React-Router](https://junglewise.ai/threats/technologies/react-router): 1 vulnerability
14. TanStack Router-Core: 1 vulnerability
15. TanStack Solid-Router: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 25 to 31 May 2026 (week 22)", https://junglewise.ai/threats/exploited/2026-05-25, 2 October 2026.