acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114126 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114126 Source advisory: OSV:GHSA-PX85-F4Q5-JH77...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114126 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114126 Source advisory: SNYK:JS-STORYBOOKADDONVITEST-21460710...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114126 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114126 Source advisory: GHSA-PX85-F4Q5-JH77...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: SNYK:JS-STORYBOOKADDONVITEST-21689167...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: OSV:GHSA-F2PH-CMG5-WXC8...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: GHSA-F2PH-CMG5-WXC8...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114126 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114126 Source advisory: MEND:CVE-2026-114126...

acinguiux-dnr-components (>=3.9.1, <=4.0.4), acinguiux-ds-react-framework (>=0.1.26, <=0.1.29) +1 more potentially affected by CVE-2026-114125 via @storybook/addon-vitest (>=10.2.0, <=10.5.9)

@storybook/addon-vitest NPM version =10.2.0, =3.9.1, =0.1.26, =0.0.8, =0.0.21 Source cves: CVE-2026-114125 Source advisory: MEND:CVE-2026-114125...

EUVD-2026-91668

Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

CVE-2026-49455: Cross-Site Request Forgery (CSRF)

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

react2shell-poc

日本語 !CAUTION For Authorized Security Re...

Argus: Reorchestrating Static Analysis Via a Multi-Agent Ensemble for Full-Chain Security Vulnerability Detection

Recent advancements in Large Language Models LLMs have sparked interest in their application to Static Application Security Testing SAST, primarily due to their superior contextual reasoning capabilities compared to traditional symbolic or rule-based methods. However, existing LLM-based approache...