CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens
[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials
Eigent CI Workflow Remote Code Execution via pull_request_target Misconfiguration (CVE-2026-22869)
[Affected Scope] The .github/workflows/ci.yml workflow configuration in the Eigent open-source repository
[Impact] Arbitrary code execution from fork pull requests, allowing attackers to steal credentials, push unauthorized code, or create malicious releases
[Mitigation] Apply the official patch commits or update the GitHub Actions workflow configuration to restrict untrusted code execution