CVE-2025-55182

CVE-2025-55182 React2Shell PoC среда Предупреждение : Этот проект предназначен только для исследовательских и образовательных целей. Использование на чужих системах без разрешения незаконно. Обзор уязвимости Пункт| Содержание ---|--- CVE ID| CVE-2025-55182 Псевдоним| React2Shell Оценка CVSS| 10.0...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

Exploit for Improper Authorization in Vercel Next.Js

React2Shell Scanner CVE-2025-29927 — Next.js Server Ac...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...

Malicious Package

Overview generator-epic-react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3308 more potentially affected by CVE-2026-101903 via axios (>=1.16.1, <=1.19.0)

axios NPM version =1.16.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...

@vaadin/react-components-pro (>=25.0.0, <=25.1.11), @vaadin/vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.0.0, <=25.1.11)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)

@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=25.2.0, <=25.2.8), @vaadin/vaadin (>=25.2.0, <=25.3.0-alpha3) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.2.0, <=25.2.8)

@vaadin/charts NPM version =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@hilla/react-components (>=2.0.0, <=2.4.0-alpha2), @hilla/react-crud (>=2.3.0-beta1, <=2.5.8) +6 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.0.0, <=24.9.17)

@vaadin/charts NPM version =24.0.0, =2.0.0, =2.3.0-beta1, =2.3.0-alpha1, =24.4.0-alpha10, =24.4.0-alpha12, =24.4.0-alpha10, =24.0.0-rc3, =24.10.0-alpha1 - hilla-admin-react 1.0.0 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@hilla/react-components (>=1.3.0-alpha3, <=1.6.4), @majinno/vaadin-components-import (>=1.0.1, <=1.0.16) +4 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=23.0.0, <=23.6.4)

@vaadin/charts NPM version =23.0.0, =1.3.0-alpha3, =1.0.1, =23.0.0, =23.0.14, =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/hilla-react-crud (>=25.2.0, <=25.3.0-alpha2), @vaadin/react-components (>=25.2.0, <=25.2.8) +3 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.2.0, <=25.2.8)

@vaadin/component-base NPM version =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=24.10.0, <=24.10.4), @vaadin/vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.10.0, <=24.10.4)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

CVE-2026-92712

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-89685

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

Malicious Package

Overview react-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-103099

Name of the Vulnerable Software and Affected Versions ReactPress – Create React App for WordPress versions prior to 3.4.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can...