CVE-20XX-?

Being exploited right now.

CVEs that CISA lists as exploited in real attacks, newest additions first.

1 CVEs · updated 2026-11-06 05:50 UTC

Reset all
  1. CVE-2025-54313

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

    exploited Code execution Library Prettier eslint-config-prettier

    7.5 HIGH 5% exploit odds No fix listed

These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.