Vulnerabilities
Summary — last 7 days
New vulnerabilities3,454▼ 1,360 vs. last week
Critical / high1,321▼ 1,441 vs. last week
New active exploitation (KEV)13▲ 6 vs. last week
Unscored (no CVSS)693▲ 630 vs. last week
More filters
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Critical (9.3) | 0.52% | — | Tanstack Start-server-coreAITanstack React-startAITanstack Solid-startAITanstack Vue-startAI | 10/13/2026 | 10/16/2026 | TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can… | |
| Analyzed | Critical (9.6) | 1.1% | ⚠ Active exploitationPoC | Tanstack/arktype-adapterTanstack/eslint-plugin-routerTanstack/eslint-plugin-startTanstack/history+167 | 5/12/2026 | 6/17/2026 | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The… | |
| Analyzed | High (7.6) | 0.43% | — | Clerk/astroClerk/backendClerk/chrome-extensionClerk/clerk-expo+13 | 5/11/2026 | 6/17/2026 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a… |