Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1027

T1027Obfuscated Files or Information

T1027 — Obfuscated Files or Information is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 43 detection use cases covering it and 401 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
43Use cases
401Articles
18Sub-techniques
1Tactic

Sub-techniques (18)

T1027.001 · Binary PaddingT1027.010 · Command ObfuscationT1027.004 · Compile After DeliveryT1027.015 · CompressionT1027.007 · Dynamic API ResolutionT1027.009 · Embedded PayloadsT1027.013 · Encrypted/Encoded FileT1027.011 · Fileless StorageT1027.006 · HTML SmugglingT1027.005 · Indicator Removal from ToolsT1027.018 · Invisible UnicodeT1027.016 · Junk Code InsertionT1027.012 · LNK Icon SmugglingT1027.014 · Polymorphic CodeT1027.002 · Software PackingT1027.003 · SteganographyT1027.008 · Stripped PayloadsT1027.017 · SVG Smuggling

Use cases covering this technique (43)

File hash IOCs — endpoint file/process match Internal install · alerting DSΣP PowerShell encoded / obfuscated command Internal exploit · alerting DSΣP [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package-install lifecycle script harvests local credentials and beacons to a non-baselined domain Internal install · alerting DSPDD [WEEKLY] Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry Internal install · alerting DSPDD Curl Execution with Percent Encoded URL ESCU actions · hunting P Linux Decode Base64 to Shell ESCU actions · alerting P Linux Obfuscated Files or Information Base64 Decode ESCU actions · hunting P Malicious PowerShell Process - Encoded Command ESCU actions · hunting P Powershell Fileless Script Contains Base64 Encoded Content ESCU actions · alerting P Wermgr Process Create Executable File ESCU actions · alerting P Windows Snake Malware File Modification Crmlog ESCU actions · alerting P Windows TinyCC Shellcode Execution ESCU actions · alerting P Cisco Secure Firewall - Lumma Stealer Activity ESCU actions · alerting P Cisco Secure Firewall - Repeated Malware Downloads ESCU actions · hunting P Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts ESCU actions · hunting P [LLM] Browser-assembled SourTrade executable dropped with campaign-domain origin (MotW) Bespoke install · hunting DSPDDCS [LLM] OkoBot HDUtil launcher execution (target/nouac) with HWID guardrail Bespoke install · alerting DSΣPDDCS [LLM] Malicious @injectivelabs SDK build artifact by SHA-256 on disk Bespoke install · hunting DSΣPDDCS [LLM] Langroid eval() exploit signature: __import__('os') / full_eval=True in cmdline or app logs Bespoke exploit · alerting DSΣPDDCS [LLM] BusySnake Python stealer executed from %APPDATA%\WindowsHelper (module.pyw) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Missed incidents, persistent threats, and response gaps: Insights from compromis Bespoke exploit · hunting DSP [LLM] Bun runtime executing a temp payload spawned by node (Miasma Node.js-monitoring evasion) Bespoke exploit · hunting DSΣPDDCS [LLM] cluw infostealer and malicious ClawHub skill payload hashes on macOS Bespoke install · hunting DSΣPCS [LLM] macOS.Gaslight known-bad file hashes (Mach-O implant, BONZAI sibling, Python/bash stages) Bespoke install · hunting DSΣPCS [LLM] Hades import-hook payload artifacts dropped (_index.js, _hooks.py, _runtime.bin, .bun_ran, b.zip) Bespoke install · alerting DSΣPDDCS [LLM] node-ipc stealer __ntw=1 environment marker in process command line Bespoke install · alerting DSΣPDDCS [LLM] TeamPCP Mini Shai-Hulud stealer payload hash match (SHA256/SHA1) Bespoke install · alerting DSΣPDDCS [LLM] Mini Shai-Hulud router_init.js dropped at npm package root in node_modules Bespoke install · alerting DSΣPDDCS [LLM] Mini Shai-Hulud Wave 4 (TanStack/TeamPCP) worm payload file created in node_modules Bespoke install · hunting DSΣPDD [LLM] Known-malicious bw_setup.js / bw1.js SHA256 dropped under @bitwarden/cli Bespoke install · alerting DSΣPDDCS [LLM] lightning PyPI compromise artifacts: start.py / router_runtime.js write Bespoke install · hunting DSΣPDD [LLM] Mini Shai-Hulud payload file drop: setup.mjs/execution.js by hash & size in node_modules Bespoke install · hunting DSΣPDD Article-specific behavioural hunt — axios Compromised on npm - Malicious Versions Drop Remote Access Trojan Bespoke exploit · hunting DSP [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) Bespoke install · alerting DSΣP [LLM] ForceMemo: init.json persistence file or i.js loader dropped by Python in user home root Bespoke install · hunting DSΣPDD Article-specific behavioural hunt — Glassworm Strikes Popular React Native Phone Number Packages Bespoke exploit · hunting DSP [LLM] XZ Utils (CVE-2024-3094) build-time backdoor extraction from disguised test corpus Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Ja Bespoke exploit · hunting DSP [LLM] Execution / write of ESET APT Q2-Q3 2025 known-bad SHA256 payload Bespoke install · hunting DSΣPDDCS [LLM] cups-browsed writing new PPD or config under /etc/cups or /var/cache/cups Bespoke install · hunting DSΣPDDCS [LLM] gxm-reference encrypted-payload artifacts written to disk (obfusc/mac/win/lin .enc.js) Bespoke delivery · alerting DSΣPDDCS [LLM] File dropped with invisible Unicode in its name (Hangul Filler U+3164 masquerading) Bespoke weapon · alerting DSΣPDDCS

Articles citing this technique (401)

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-00
high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access art-02
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-29
crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-33
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process art-63
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit Don’t swing at everything art-106
crit Email threat landscape: Q2 2026 trends and insights art-108
crit Russian Global Webmail Espionage art-111
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-114
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-115
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-116
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-130
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-132
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-142
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-145
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-152
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-153
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-158
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
high AsyncAPI npm packages backdoored via GitHub Actions art-181
med Forgotten UEFI shims undermining Secure Boot art-182
high How Aikido Intel detects malware and vulnerabilities first art-189
crit What is a dependency firewall? art-192
crit jscrambler npm package publishes malicious preinstall binary art-195
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-215
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-216
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit UAT-7810 continues building ORB networks using new malware art-229
crit [GHSA / CRITICAL] CVE-2026-54769: Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent art-238
high Cyber readiness for SMBs: Getting the basics right art-249
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high StepSecurity Maintained Actions Are Now Free for Public Repos art-252
high Catan and Mouse art-261
crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265
crit Secure Registry now tells you which machine pulled a compromised package art-271
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-272
high Maven Support Comes to GitHub Checks and OSS Package Search art-273
high Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised art-274
high simonecorsi/mawesome GitHub Action has been compromised art-275
high codfish/semantic-release-action GitHub Action has been compromised art-276
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
high npm now freezes high-impact accounts after risky account changes art-288
high Top Koi alternatives in 2026 art-290
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Everybody's shipping code they can't read art-295
crit CISA KEV: CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability art-297
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-314
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-317
high The full Snyk AI Security Platform, free for open source maintainers art-319
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-328
crit Inside the Modern SOC: The 72-Minute Race art-330
high 5 Socket security alternatives and why they are better art-337
crit CISA KEV: CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability art-338
high npm v12 delivers one of the biggest security improvements in years art-339
crit OceanLotus: From external espionage to domestic targeting art-342
high Code is being written everywhere, and the device is the only constant art-344
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-352
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-358
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-361
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Why EDR and proxy won’t save you from supply chain malware art-369
high Multiple redhat-cloud-services npm Packages compromised art-370
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-371
high Nx Console VS Code Extension Compromised art-373
high Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection art-375
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-379
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-380
high What MDM can't protect on developer machines (and what to do about it) art-386
crit CISA KEV: CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability art-393
crit CISA KEV: CVE-2026-45321 — TanStack Unspecified Vulnerability art-394
crit CISA KEV: CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability art-395
high Why developer machines are now the number one target for supply chain attacks art-396
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-397
crit Laravel Lang Supply Chain Advisory art-399
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-401
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-411
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
crit Webworm: New burrowing techniques art-413
crit CISA KEV: CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability art-418
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit Fake call logs, real payments: How CallPhantom tricks Android users art-447
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-462
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit GopherWhisper: A burrow full of malware art-484
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
crit What the ransom note won’t say art-492
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-517
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-553
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-554
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-557
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit EDR killers explained: Beyond the drivers art-577
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-585
high Glassworm Strikes Popular React Native Phone Number Packages art-587
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-594
crit Sednit reloaded: Back in the trenches art-596
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
high 2024 in Review: The Evolution of CI/CD Security & What's Next art-641
high Harden-Runner detection: tj-actions/changed-files action is compromised art-656
high Why Your “Skill Scanner” Is Just False Security (and Maybe Malware) art-661
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-672
crit DynoWiper update: Technical analysis and attribution art-684
high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-696
high The Holiday Whisper: Shai-Hulud 3.0 art-721
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-753
high SHA1-Hulud, npm supply chain incident art-766
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773
crit CISA KEV: CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-790
crit The who, where, and how of APT attacks in Q2 2025–Q3 2025 art-792
crit CISA KEV: CVE-2025-24893 — XWiki Platform Eval Injection Vulnerability art-801
crit CISA KEV: CVE-2025-61932 — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability art-808
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
crit CISA KEV: CVE-2025-61882 — Oracle E-Business Suite Unspecified Vulnerability art-832
crit CISA KEV: CVE-2025-21043 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-836
crit CISA KEV: CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability art-841
crit CISA KEV: CVE-2025-20352 — Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability art-842
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
crit CISA KEV: CVE-2025-5086 — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability art-853
crit CISA KEV: CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability art-859
crit CISA KEV: CVE-2025-8088 — RARLAB WinRAR Path Traversal Vulnerability art-877
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-879
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
crit CISA KEV: CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability art-899
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-902
crit CISA KEV: CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability art-904
crit CISA KEV: CVE-2023-33538 — TP-Link Multiple Routers Command Injection Vulnerability art-925
crit CISA KEV: CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability art-931
crit CISA KEV: CVE-2024-42009 — RoundCube Webmail Cross-Site Scripting Vulnerability art-933
crit CISA KEV: CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability art-946
crit CISA KEV: CVE-2024-27443 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-958
crit CISA KEV: CVE-2025-27920 — Srimax Output Messenger Directory Traversal Vulnerability art-959
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-960
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-961
crit CISA KEV: CVE-2025-4427 — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability art-962
crit CISA KEV: CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability art-963
crit CISA KEV: CVE-2024-12987 — DrayTek Vigor Routers OS Command Injection Vulnerability art-964
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-965
crit CISA KEV: CVE-2024-11120 — GeoVision Devices OS Command Injection Vulnerability art-974
crit CISA KEV: CVE-2024-6047 — GeoVision Devices OS Command Injection Vulnerability art-975
crit CISA KEV: CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability art-984
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-990
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-994
crit CISA KEV: CVE-2025-29824 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-998
crit CISA KEV: CVE-2025-30406 — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability art-999
crit CISA KEV: CVE-2025-31161 — CrushFTP Authentication Bypass Vulnerability art-1000
crit CISA KEV: CVE-2025-22457 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-1001
crit CISA KEV: CVE-2025-2783 — Google Chromium Mojo Sandbox Escape Vulnerability art-1007
crit CISA KEV: CVE-2025-30154 — reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability art-1010
crit CISA KEV: CVE-2025-30066 — tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability art-1018
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1019
crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-1020
crit CISA KEV: CVE-2025-21590 — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability art-1023
crit CISA KEV: CVE-2025-26633 — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability art-1034
crit CISA KEV: CVE-2024-57968 — Advantive VeraCore Unrestricted File Upload Vulnerability art-1038
crit CISA KEV: CVE-2025-25181 — Advantive VeraCore SQL Injection Vulnerability art-1039
crit CISA KEV: CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability art-1045
crit CISA KEV: CVE-2023-20118 — Cisco Small Business RV Series Routers Command Injection Vulnerability art-1051
crit CISA KEV: CVE-2024-41710 — Mitel SIP Phones Argument Injection Vulnerability art-1069
crit CISA KEV: CVE-2025-0994 — Trimble Cityworks Deserialization Vulnerability art-1074
crit CISA KEV: CVE-2025-0411 — 7-Zip Mark of the Web Bypass Vulnerability art-1080
crit CISA KEV: CVE-2024-50603 — Aviatrix Controllers OS Command Injection Vulnerability art-1095
crit CISA KEV: CVE-2025-0282 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-1107
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1114
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1121
high Ultralytics AI Pwn Request Supply Chain Attack art-1125
crit CISA KEV: CVE-2024-11667 — Zyxel Multiple Firewalls Path Traversal Vulnerability art-1133
crit CISA KEV: CVE-2024-9474 — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability art-1148
crit CISA KEV: CVE-2024-0012 — Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability art-1149
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1161
crit CISA KEV: CVE-2024-47575 — Fortinet FortiManager Missing Authentication Vulnerability art-1175
crit CISA KEV: CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability art-1178
crit CISA KEV: CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability art-1186
crit CISA KEV: CVE-2024-9380 — Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability art-1191
crit CISA KEV: CVE-2023-25280 — D-Link DIR-820 Router OS Command Injection Vulnerability art-1206
high Zero-day RCE vulnerability found in CUPS - Common UNIX Printing System art-1207
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1213
crit CISA KEV: CVE-2014-0497 — Adobe Flash Player Integer Underflow Vulnerablity art-1223
crit CISA KEV: CVE-2024-6670 — Progress WhatsUp Gold SQL Injection Vulnerability art-1225
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1227
crit CISA KEV: CVE-2024-38217 — Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability art-1228
crit CISA KEV: CVE-2024-7262 — Kingsoft WPS Office Path Traversal Vulnerability art-1238
crit CISA KEV: CVE-2024-39717 — Versa Director Dangerous File Type Upload Vulnerability art-1248
crit CISA KEV: CVE-2024-38213 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1263
crit CISA KEV: CVE-2024-38178 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-1264
crit CISA KEV: CVE-2018-0824 — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability art-1271
crit CISA KEV: CVE-2012-4792 — Microsoft Internet Explorer Use-After-Free Vulnerability art-1280
crit CISA KEV: CVE-2024-36401 — OSGeo GeoServer GeoTools Eval Injection Vulnerability art-1287
crit CISA KEV: CVE-2024-23692 — Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability art-1291
crit CISA KEV: CVE-2024-26169 — Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability art-1308
crit CISA KEV: CVE-2024-4577 — PHP-CGI OS Command Injection Vulnerability art-1312
crit CISA KEV: CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability art-1319
crit CISA KEV: CVE-2024-1086 — Linux Kernel Use-After-Free Vulnerability art-1321
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1324
med Preventing broken access control in express Node.js applications art-1328
crit CISA KEV: CVE-2024-4947 — Google Chromium V8 Type Confusion Vulnerability art-1331
crit CISA KEV: CVE-2024-3400 — Palo Alto Networks PAN-OS Command Injection Vulnerability art-1362
crit CISA KEV: CVE-2024-3273 — D-Link Multiple NAS Devices Command Injection Vulnerability art-1364
crit The XZ backdoor CVE-2024-3094 art-1369
high GitHub “besieged” by malware repositories and repo confusion: Why you'll be ok art-1379
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1396
crit CISA KEV: CVE-2023-46805 — Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability art-1431
crit CISA KEV: CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1437
crit CISA KEV: CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1438
crit CISA KEV: CVE-2023-7101 — Spreadsheet::ParseExcel Remote Code Execution Vulnerability art-1442
crit CISA KEV: CVE-2023-49897 — FXC AE1021, AE1021PE OS Command Injection Vulnerability art-1447
crit CISA KEV: CVE-2023-47565 — QNAP VioStor NVR OS Command Injection Vulnerability art-1448
crit CISA KEV: CVE-2023-41266 — Qlik Sense Path Traversal Vulnerability art-1459
crit CISA KEV: CVE-2023-41265 — Qlik Sense HTTP Tunneling Vulnerability art-1460
crit CISA KEV: CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability art-1487
crit CISA KEV: CVE-2023-36033 — Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability art-1495
crit CISA KEV: CVE-2023-47246 — SysAid Server Path Traversal Vulnerability art-1499
med Real-time threat protection with Snyk and SentinelOne art-1506
crit CISA KEV: CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability art-1511
crit CISA KEV: CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1521
crit CISA KEV: CVE-2023-42793 — JetBrains TeamCity Authentication Bypass Vulnerability art-1552
high Modern VS Code extension development tutorial: Building a secure extension art-1556
crit CISA KEV: CVE-2023-41991 — Apple Multiple Products Improper Certificate Validation Vulnerability art-1562
crit CISA KEV: CVE-2023-33246 — Apache RocketMQ Command Execution Vulnerability art-1589
crit CISA KEV: CVE-2023-27532 — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability art-1603
high What are AI hallucinations and why should developers care? art-1606
crit CISA KEV: CVE-2023-3519 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability art-1637
crit CISA KEV: CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability art-1641
crit CISA KEV: CVE-2022-29303 — SolarView Compact Command Injection Vulnerability art-1643
crit CISA KEV: CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability art-1648
med Building a security-conscious CI/CD pipeline art-1653
crit CISA KEV: CVE-2019-17621 — D-Link DIR-859 Router Command Execution Vulnerability art-1655
crit CISA KEV: CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability art-1656
crit CISA KEV: CVE-2023-34362 — Progress MOVEit Transfer SQL Injection Vulnerability art-1701
crit CISA KEV: CVE-2023-2868 — Barracuda Networks ESG Appliance Improper Input Validation Vulnerability art-1707
crit Data loss prevention for developers art-1710
crit CISA KEV: CVE-2023-25717 — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability art-1727
crit CISA KEV: CVE-2023-28252 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-1770
crit CISA KEV: CVE-2021-27876 — Veritas Backup Exec Agent File Access Vulnerability art-1775
crit CISA KEV: CVE-2021-27877 — Veritas Backup Exec Agent Improper Authentication Vulnerability art-1776
crit CISA KEV: CVE-2021-27878 — Veritas Backup Exec Agent Command Execution Vulnerability art-1777
crit CISA KEV: CVE-2023-24880 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1812
crit CISA KEV: CVE-2022-41328 — Fortinet FortiOS Path Traversal Vulnerability art-1813
high API authentication vulnerability found in Snyk Kubernetes integration (CVE-2023-1065) art-1827
crit CISA KEV: CVE-2015-2291 — Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability art-1846
crit CISA KEV: CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability art-1861
high Supply chain security incident at CircleCI: Rotate your secrets art-1872
crit CISA KEV: CVE-2022-42475 — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability art-1889
crit CISA KEV: CVE-2022-44698 — Microsoft Defender SmartScreen Security Feature Bypass Vulnerability art-1890
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1924
crit CISA KEV: CVE-2022-41128 — Microsoft Windows Scripting Languages Remote Code Execution Vulnerability art-1933
crit CISA KEV: CVE-2018-19323 — GIGABYTE Multiple Products Privilege Escalation Vulnerability art-1956
crit CISA KEV: CVE-2018-19320 — GIGABYTE Multiple Products Unspecified Vulnerability art-1959
crit CISA KEV: CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability art-2045
crit CISA KEV: CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability art-2100
crit CISA KEV: CVE-2022-29499 — Mitel MiVoice Connect Data Validation Vulnerability art-2109
crit CISA KEV: CVE-2022-30190 — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability art-2121
crit CISA KEV: CVE-2012-0754 — Adobe Flash Player Memory Corruption Vulnerability art-2148
crit CISA KEV: CVE-2011-2462 — Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability art-2150
crit CISA KEV: CVE-2022-26134 — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability art-2165
crit CISA KEV: CVE-2016-0034 — Microsoft Silverlight Runtime Remote Code Execution Vulnerability art-2174
crit CISA KEV: CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability art-2176
crit CISA KEV: CVE-2013-2423 — Oracle JRE Unspecified Vulnerability art-2195
crit CISA KEV: CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability art-2198
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2203
crit CISA KEV: CVE-2017-0005 — Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability art-2210
crit CISA KEV: CVE-2019-13720 — Google Chrome WebAudio Use-After-Free Vulnerability art-2236
crit CISA KEV: CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability art-2237
crit Targeted npm dependency confusion attack caught red-handed art-2273
crit CISA KEV: CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability art-2298
crit CISA KEV: CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability art-2310
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2311
crit CISA KEV: CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability art-2327
crit CISA KEV: CVE-2021-21551 — Dell dbutil Driver Insufficient Access Control Vulnerability art-2350
crit CISA KEV: CVE-2018-10562 — Dasan GPON Routers Command Injection Vulnerability art-2351
crit CISA KEV: CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability art-2368
crit CISA KEV: CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability art-2369
crit CISA KEV: CVE-2013-2465 — Oracle Java SE Unspecified Vulnerability art-2379
crit CISA KEV: CVE-2020-9054 — Zyxel Multiple NAS Devices OS Command Injection Vulnerability art-2393
crit CISA KEV: CVE-2019-1132 — Microsoft Win32k Privilege Escalation Vulnerability art-2467
crit CISA KEV: CVE-2019-11581 — Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability art-2489
crit CISA KEV: CVE-2021-41379 — Microsoft Windows Installer Privilege Escalation Vulnerability art-2504
crit CISA KEV: CVE-2011-0611 — Adobe Flash Player Remote Code Execution Vulnerability art-2584
high Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters art-2597
crit CISA KEV: CVE-2022-0609 — Google Chromium Animation Use-After-Free Vulnerability art-2617
crit CISA KEV: CVE-2013-3906 — Microsoft Graphics Component Memory Corruption Vulnerability art-2624
crit CISA KEV: CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability art-2635
crit CISA KEV: CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability art-2636
crit CISA KEV: CVE-2015-2051 — D-Link DIR-645 Router Remote Code Execution Vulnerability art-2641
crit CISA KEV: CVE-2021-32648 — October CMS Improper Authentication art-2674
crit CISA KEV: CVE-2021-36260 — Hikvision Improper Input Validation art-2695
crit CISA KEV: CVE-2019-2725 — Oracle WebLogic Server, Injection art-2699
crit CISA KEV: CVE-2021-44515 — Zoho Desktop Central Authentication Bypass Vulnerability art-2737
crit CISA KEV: CVE-2021-44077 — Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability art-2757
crit CISA KEV: CVE-2021-27104 — Accellion FTA OS Command Injection Vulnerability art-2780
crit CISA KEV: CVE-2021-27102 — Accellion FTA OS Command Injection Vulnerability art-2781
crit CISA KEV: CVE-2021-27101 — Accellion FTA SQL Injection Vulnerability art-2782
crit CISA KEV: CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability art-2783
crit CISA KEV: CVE-2018-4878 — Adobe Flash Player Use-After-Free Vulnerability art-2788
crit CISA KEV: CVE-2021-30657 — Apple macOS Unspecified Vulnerability art-2816
crit CISA KEV: CVE-2021-30869 — Apple iOS, iPadOS, and macOS Type Confusion Vulnerability art-2820
crit CISA KEV: CVE-2021-26084 — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability art-2827
crit CISA KEV: CVE-2020-25506 — D-Link DNS-320 Device Command Injection Vulnerability art-2849
crit CISA KEV: CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability art-2853
crit CISA KEV: CVE-2021-30116 — Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability art-2893
crit CISA KEV: CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability art-2894
crit CISA KEV: CVE-2021-31955 — Microsoft Windows Kernel Information Disclosure Vulnerability art-2902
crit CISA KEV: CVE-2021-31199 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2909
crit CISA KEV: CVE-2021-31956 — Microsoft Windows NTFS Privilege Escalation Vulnerability art-2911
crit CISA KEV: CVE-2021-31201 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2912
crit CISA KEV: CVE-2017-7269 — Microsoft Windows Server Buffer Overflow Vulnerability art-2920
crit CISA KEV: CVE-2021-34473 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2927
crit CISA KEV: CVE-2021-1732 — Microsoft Win32k Privilege Escalation Vulnerability art-2929
crit CISA KEV: CVE-2021-34527 — Microsoft Windows Print Spooler Remote Code Execution Vulnerability art-2930
crit CISA KEV: CVE-2021-26857 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2969
crit CISA KEV: CVE-2020-11652 — SaltStack Salt Path Traversal Vulnerability art-3003
crit CISA KEV: CVE-2020-11651 — SaltStack Salt Authentication Bypass Vulnerability art-3004
crit CISA KEV: CVE-2020-10148 — SolarWinds Orion Authentication Bypass Vulnerability art-3013
crit CISA KEV: CVE-2018-14558 — Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability art-3027
crit CISA KEV: CVE-2019-16759 — vBulletin PHP Module Remote Code Execution Vulnerability art-3039
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3048
crit CISA KEV: CVE-2020-10189 — Zoho ManageEngine Desktop Central File Upload Vulnerability art-3053
high 5 potential risks of open source software art-3133
high SuiteCRM: PHAR deserialization vulnerability to code execution art-3165
high Developer driven workflows: Dockerfile image scanning, prioritization, and remediation art-3190
high AWS vulnerability scanning using the Snyk integration art-3214
high Container image formats under the hood art-3257
high SourMint malicious SDK research write up art-3280
high SourMint: iOS remote code execution, Android findings, and community response art-3282
high SourMint malicious SDK research writeup art-3313
high What is a backdoor? Let’s build one with Node.js art-3398
high Everything you wanted to know about addressing security vulnerabilities in Linux-based containers art-3478
high A technical analysis of the Capital One cloud misconfiguration breach art-3495
high Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem art-3545
high Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months art-3585
high Using the Snyk API to find and fix vulnerabilities art-3627
high Yarn is Micro Secure art-3668
high Keeping your open source credentials closed art-3691