Vendor

TanStack

1 of 2 TanStack CVEs in Patchfirst (50%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs: 2
In CISA KEV: 150%
Known ransomware use: 1
Median days to KEV: 15; from publication
Latest KEV listing: 27 May 2026

Watch TanStack Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
TanStack In KEV: 1 CVEs: 1
router In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with TanStack CVEs

TechniqueCVEs
T1195.002Compromise Software Supply Chain CVEs: 1
T1528Steal Application Access Token CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/tanstack.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are TanStack CVEs linked to the technique. Each link’s provenance is on the CVE page.

TanStack CVEs

2 CVEs, by priority

CVE-2026-45321TanStack Unspecified Vulnerability
TanStack · TanStackKEVRansomwarePublic exploitCritical · 9.6T1195.002Compromise Software Supply Chain T1528Steal Application Access Token1 report
3.3%Top 12%
86.3priority
CVE-2026-102989TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web
TanStack · routerCritical · 9.3
0.5%Top 54%
17.8priority