Vendors / Uipath Records 6 All Threatist records
Exploited (KEV) 1
CVSS critical 3
CVSS high 1
Exploited now Uipath records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority CRITICAL 100KEV
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.
CVSS 3.1 CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.03278 · Published 2026-05-12 · Fixed in 1.166.16, 1.161.13 +26 CWE-506
Priority MEDIUM 46
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01805 · Published 2021-12-14 · No fix listed CWE-610
Priority MEDIUM 44
An issue was discovered in UiPath Assistant 21.4.4.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01119 · Published 2021-12-14 · No fix listed CWE-116
Priority MEDIUM 41
UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege escalation and remote code execution.
CVSS 3.0 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01503 · Published 2019-04-11 · No fix listed CWE-732
Priority LOW 27
UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.
CVSS 3.0 MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01089 · Published 2019-08-08 · No fix listed CWE-1236
Priority LOW 25
An issue was discovered in UiPath App Studio 21.4.4.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00471 · Published 2021-12-14 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 1 2 0 0
THREATIST.IORead the docs