1825 matches found
React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components
Overview Update 1: As of 4:30 PM Eastern, December 4, 2025, Rapid7 has validated that a working weaponizedproof-of-concept exploit ,shared by researcher@maple3142 , is now publicly available. Update 2: On December 5, 2025,Lachlan Davidson who discovered the vulnerability has also published...
Exploit for CVE-2025-55182
React 19 & Next.js Security Fix Prompts for AI Agents 🚨 CRI...
ZEIT Next.js Remote Code Execution Vulnerability
Next.js is a React framework for building full-stack web applications. ZEIT Next.js suffers from a remote code execution vulnerability that stems from Next.js versions 15.x and 16.x relying on a flawed React server-side DOM package when using App Router, which can be exploited by an attacker to...
@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by CVE-2025-55182 +1 more via next (>=15.4.0-canary.17, <=15.4.7)
next NPM version =15.4.0-canary.17, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.0.0-dev-20250910232631, =0.1.7, =0.1.8 and more Source cves: CVE-2025-55182, CVE-2025-71389 Source advisory: OSV:GHSA-9QR9-H5GF-34MP...
GHSA-9QR9-H5GF-34MP Next.js is vulnerable to RCE in React flight protocol
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182. Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js:...
EUVD-2025-200984
This CVE is a duplicate of CVE-2025-55182...
Next.js is vulnerable to RCE in React flight protocol
A vulnerability affects certain React packages1 for versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-55182. Fixed in: React: 19.0.1, 19.1.2, 19.2.1 Next.js:...
K000158059: Next.js vulnerability CVE-2025-66478
Security Advisory Description This CVE is a duplicate of CVE-2025-55182. CVE-2025-66478 For the F5 response to CVE-2025-55182, refer to K000158058: React framework vulnerability CVE-2025-55182. Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status...
Exploit for CVE-2025-55182
GitHub CVE Scanner 🔍 Quickly scan GitHub repositories for c...
React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability
Detect and mitigate React2Shell CVE-2025-55182, critical RCE vulnerability in React and Next.js exploited in the wild. Organizations should patch urgently...
CVE-2025-55182: React and Next.js Server Functions Deserialization RCE
...
PT-2026-64182
Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 5.9.9 Description Unauthenticated remote code execution is possible because the software bundles a version of Next.js where React Server Components RSC request handling deserializes attacker-controlled input. A remote...
CVE-2025-64762
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...
CVE-2025-64762: Use of Cache Containing Sensitive Information
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...
PT-2025-47657
Name of the Vulnerable Software and Affected Versions AuthKit-nextjs versions 2.11.0 and below Description The AuthKit library for Next.js, used for authentication and session management, does not apply anti-caching headers to authenticated responses in versions 2.11.0 and below. This can lead to...
Security Bulletin: IBM Security QRadar Network Threat Analytics app for IBM QRadar SIEM includes a component with known vulnerabilities (CVE-2025-29927 & CVE-2025-48068)
Summary The product includes a vulnerable component e.g., framework library that may be identified and exploited with automated tools. IBM Security QRadar Network Threat Analytics app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-29927 DESCRIPTION:...
Exploit for Race Condition in Vercel Next.Js
CVE-2025-32421 Eclipse Technique Lab Comprehensive demonstrat...
EUVD-2018-0672
Malware in sbrugna...