Records2All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
mesa records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsPriority CRITICAL 100KEV
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.03278 · Published 2026-05-12 · Fixed in 1.166.16, 1.161.13 +26 CWE-506
Priority MEDIUM 48
Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00408 · Published 2026-03-06 · No fix listed CWE-94
