Vendor
TanStack
- CVEs tracked · all time
- 2
- in CISA KEV · all time
- 1
- article · since 11 Sep
- 1
- articles · all time
- 9
One article in the last 45 daysThe latest: SecurityOnline, Wed 14 Oct, 01:11 UTC.See the full timeline
Products: react-start, router, solid-start, start-server-core and 2 more
react-startroutersolid-startstart-server-coreTanStackvue-start
CVEs
2 CVEsCVE-2026-102989TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesCVSS9.3Critical–Not in KEV0.5%EPSS1article
- Unauthenticated TanStack flaw lets attackers run scripts through malicious linksSecurityOnline
- CISA warns of Daemon Tools, TanStack and Nx Console flawsSecurity Affairs
- State-Sponsored Actors Operationalize ROADtools Framework in Cloud CampaignsSecurityOnline
- Showboat malware leverages critical CVEs to spy on telecomsSecurityOnline
- FortiClient EMS flaw used to drop EKZ Infostealer via fake updatesSecurityOnline
- Motorola Fixes Amazon App Redirect Bug After Smart Feed AbuseSecurityOnline
- CISA warns CVE-2026-45321 in TanStack npm threatens credentialsCISA · official notice
- CISA Adds CVE-2026-45321 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More PackagesThe Hacker News · first in our coverage