@
Vendor security profile1 actively exploited CVEs
@tanstack
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs3
Critical2
CISA KEV1
Public exploit2
Patch rate%0
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
0
0
1
0
0
1
0
1
CVE KEV
CVE severity distribution
3toplam CVE
Critical2 (67%)
Low1 (33%)
Patch and exploitation view
%0
Verified patch
%33
CISA KEV
%67
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
9.3
CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
@
Patch status unknown
2.0
CVE-2026-78177
TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
@
Patch status unknownEPSS %1
9.6
CVE-2026-45321 Actively exploited
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@
Patch status unknownEPSS %1