https://pwn.watch/t/tanstack Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Sun, 31 May 2026 00:00:00 GMT https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud Sun, 31 May 2026 00:00:00 GMT high <p>In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> https://pwn.watch/i/tanstack-tanstack-cve-2026-45321 https://pwn.watch/i/tanstack-tanstack-cve-2026-45321 Wed, 27 May 2026 00:00:00 GMT high <p>TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-05-27: CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).</li></ul> <p><strong>CVEs:</strong> CVE-2026-45321</p>