Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Oct 13, 2026TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.CVE-2026-102989 · Other software · TanStack · reported by GitHubCritical 9.3
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects.CVE-2026-96759 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2026A vulnerability was found in TanStack devtools-vite 0.7.0.CVE-2026-78177 · Other software · TanStack · reported by VulDBLow 1.1
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- devtools-vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026A vulnerability was detected in tanstack db up to 0.6.8.CVE-2026-15607 · Other software · tanstack · reported by VulDBLow 2.1
A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as ac09b1177a100eafa85cba3cd09dd1f53f933ded. A patch should be applied to remediate this issue.
- Product
- db
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026TanStack Unspecified VulnerabilityCVE-2026-45321 · Other software · TanStack · reported by GitHubExploitedRansomwareCritical 9.6
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
- Product
- TanStack
- On CISA’s list since
- May 27, 2026 (federal fix deadline Jun 10, 2026)
- What to do
- Attackers are using this now. Install TanStack’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Feb 5, 2025A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a craCVE-2024-57068 · Other software · reported by MITREHigh 7.5
A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2024TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web.CVE-2024-24558 · Other software · TanStack · reported by GitHubHigh 8.2
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.
- Product
- query
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.