Skip to content
Threat Feed
Subscribe

Vendor

Social Security Administration

2 briefs RSS
high advisory

Social Security Administration genesys: Supply chain dependency on compromised polyfill.io domain (CVE-2026-104375)

The Social Security Administration genesys toolkit and the bundled Mavo v0.2.0 library contain hardcoded references to the hostile-owned cdn.polyfill.io domain, posing a supply-chain risk of malicious script injection into downstream applications.

genesys +1 supply-chain cve-2026-104375 javascript-injection
2t 1c 2i
low advisory

Social Security Administration dce-web: Multiple Vulnerabilities (CVE-2026-104371, CVE-2026-104372, CVE-2026-104373)

The decommissioned dce-web application contained vulnerabilities involving missing Subresource Integrity (CVE-2026-104371), supply chain risks from unpinned development dependencies (CVE-2026-104372), and internal SMB path exposure (CVE-2026-104373).

dce-web web-vulnerability supply-chain information-disclosure cisa
1t 3c