See the full list of npm packages compromised in the "TanStack Supply Chain Compromise - May 2026" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
- H
Allocation of Resources Without Limits or ThrottlingCVE-2026-44240
Affects basic-ftp | Versions <5.3.1
Has fix
npmPublished 7 May 2026
- C
Arbitrary Code InjectionCVE-2026-44006
Affects vm2 | Versions <3.11.0
Has fix
npmPublished 7 May 2026
- C
Arbitrary Code InjectionCVE-2026-43997
Affects vm2 | Versions <3.11.0
Has fix
npmPublished 7 May 2026
- M
Missing AuthorizationCVE-2026-43580
Affects openclaw | Versions <2026.4.10
Has fix
npmPublished 7 May 2026
- L
Permissive List of Allowed InputsCVE-2026-44111
Affects openclaw | Versions <2026.4.15-beta.1
Has fix
npmPublished 7 May 2026
- H
Missing AuthorizationCVE-2026-43577
Affects openclaw | Versions <2026.4.9-beta.1
Has fix
npmPublished 7 May 2026
- H
Incorrect AuthorizationCVE-2026-44110
Affects @openclaw/matrix | Versions <2026.5.9-beta.1
Has fix
npmPublished 7 May 2026
- H
Incorrect AuthorizationCVE-2026-44110
Affects openclaw | Versions <2026.4.15-beta.1
Has fix
npmPublished 7 May 2026
Affects @evomap/evolver | Versions <1.70.0-beta.5
Has fix
npmPublished 6 May 2026
Affects @evomap/evolver | Versions <1.70.0-beta.5
Has fix
npmPublished 6 May 2026
- M
Origin Validation ErrorCVE-2026-43870
Affects thrift | Versions <0.23.0
Has fix
npmPublished 6 May 2026
- H
Allocation of Resources Without Limits or ThrottlingCVE-2026-32689
Affects phoenix | Versions >=1.7.0 <1.7.22>=1.8.0 <1.8.6
Has fix
npmPublished 6 May 2026
- H
Affects mongoose | Versions <6.13.9>=7.0.0-rc0 <7.8.9>=8.0.0-rc0 <8.22.1>=9.0.0-rc0 <9.1.6
Has fix
npmPublished 6 May 2026
- M
Cross-site Scripting (XSS)CVE-2025-69993
Affects leaflet | Versions *
No fix available
npmPublished 6 May 2026
- M
Cross-site Scripting (XSS)CVE-2025-45806
Affects rrweb-snapshot | Versions *
No fix available
npmPublished 6 May 2026
- M
Server-side Request Forgery (SSRF)CVE-2026-5832
Affects api-lab-mcp | Versions >=0.2.0
Has fix
npmPublished 6 May 2026
- H
Allocation of Resources Without Limits or ThrottlingCVE-2026-7768
Affects @fastify/accepts-serializer | Versions <6.0.4
Has fix
npmPublished 6 May 2026
Affects @tdurieux/anonymous_github | Versions >=2.2.0 <2.3.0
Has fix
npmPublished 6 May 2026
- M
Open RedirectCVE-2026-42565
Affects @workos/authkit-session | Versions <0.5.1
Has fix
npmPublished 6 May 2026
- H
Server-side Request Forgery (SSRF)CVE-2026-43929
Affects ssrfcheck | Versions <1.4.0
Has fix
npmPublished 6 May 2026
- C
Arbitrary Code InjectionCVE-2026-24781
Affects vm2 | Versions <3.11.0
Has fix
npmPublished 6 May 2026
- C
Arbitrary Code InjectionCVE-2026-24120
Affects vm2 | Versions >=3.10.0 <3.10.5
Has fix
npmPublished 6 May 2026
- H
Server-side Request Forgery (SSRF)CVE-2026-43897
Affects link-preview-js | Versions <4.0.1
Has fix
npmPublished 6 May 2026
- L
Race ConditionCVE-2026-43930
Affects parse-server | Versions <8.6.76>=9.0.0-alpha.1 <9.9.0-alpha.2
Has fix
npmPublished 6 May 2026
- C
Arbitrary Code InjectionCVE-2026-26332
Affects vm2 | Versions <3.11.0
Has fix
npmPublished 6 May 2026
- C
Arbitrary Code InjectionCVE-2026-26956
Affects vm2 | Versions <3.10.5
Has fix
npmPublished 6 May 2026
- C
Arbitrary Code InjectionCVE-2026-24118
Affects vm2 | Versions <3.11.0
Has fix
npmPublished 6 May 2026
- H
Arbitrary Code InjectionCVE-2026-45004
Affects openclaw | Versions <2026.4.23-beta.1
Has fix
npmPublished 6 May 2026