Multiagentcognition

Records1All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Multiagentcognition records in CISA KEV

Products in the NVD configurations · select one to filter the records

1 record in Cmux-agent-mcp · all components

TI-2026-33119 CVE-2026-45321 · GHSA-g7cv-rxg3-hmpx

CRITICAL 100KEV

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.03278 Published 2026-05-12 Fixed in 1.166.16, 1.161.13 +26 CWE-506