EUVD-2026-33988

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets...

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources !NOTE This only impacts your application if you are using the unstable RSC APIs in React Router...

GHSA-8646-J5J9-6R62 React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources !NOTE This only impacts your application if you are using the unstable RSC APIs in React Router...

@accounter/client (>=0.0.6-alpha-20250716191627-847a4f732a66f2443e3141d5ef77222a6579ded3, <=0.0.11-alpha-20260328161521-814e4fc7c5b0b6b919590e293c0fac45b7c2513d), @boxyhq/react-ui (>=3.5.2, <=3.5.3) +154 more potentially affected by CVE-2026-33245 via react-router (>=7.7.0, <=7.13.2-pre.0)

react-router NPM version =7.7.0, =0.0.6-alpha-20250716191627-847a4f732a66f2443e3141d5ef77222a6579ded3, =3.5.2, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =3.3.7, =3.0.0-alpha.2, =3.2.0-beta.0, =0.1.9, =0.0.1, =1.21.9, =1.21.9, =0.3.1, =0.5.1 - @depup/react-router-dom 7.13.1-depup...

@accounter/client (>=0.0.6-alpha-20250716191627-847a4f732a66f2443e3141d5ef77222a6579ded3, <=0.0.11-alpha-20260328161521-814e4fc7c5b0b6b919590e293c0fac45b7c2513d), @boxyhq/react-ui (>=3.5.2, <=3.5.3) +154 more potentially affected by CVE-2026-33245 via react-router (>=7.7.0, <=7.13.2-pre.0)

react-router NPM version =7.7.0, =0.0.6-alpha-20250716191627-847a4f732a66f2443e3141d5ef77222a6579ded3, =3.5.2, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =3.3.7, =3.0.0-alpha.2, =3.2.0-beta.0, =0.1.9, =0.0.1, =1.21.9, =1.21.9, =0.3.1, =0.5.1 - @depup/react-router-dom 7.13.1-depup...

GHSA-F22V-GFQF-P8F3 React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in statically generated HTML files if the redirect location comes from an untrusted source. !NOTE This does not impact your React...

EUVD-2026-33986

React Router has stored XSS via unescaped Location header in prerendered redirect HTML...

@accounter/client (>=0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, <=0.0.11-alpha-20260328161521-814e4fc7c5b0b6b919590e293c0fac45b7c2513d), @boxyhq/react-ui (>=3.4.1, <=3.5.3) +191 more potentially affected by CVE-2026-33244 via react-router (>=7.5.1, <=7.13.2-pre.0)

react-router NPM version =7.5.1, =0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, =3.4.1, =0.2.3, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =0.1.0, =3.3.7, =3.0.0-alpha.2, =3.2.0-beta.0, =15.9.0, =0.1.9, =0.0.1-dev.8, =0.0.2-1 and more Source cves:...

@accounter/client (>=0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, <=0.0.11-alpha-20260328161521-814e4fc7c5b0b6b919590e293c0fac45b7c2513d), @boxyhq/react-ui (>=3.4.1, <=3.5.3) +191 more potentially affected by CVE-2026-33244 via react-router (>=7.5.1, <=7.13.2-pre.0)

react-router NPM version =7.5.1, =0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, =3.4.1, =0.2.3, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =0.1.0, =3.3.7, =3.0.0-alpha.2, =3.2.0-beta.0, =15.9.0, =0.1.9, =0.0.1-dev.8, =0.0.2-1 and more Source cves:...

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in statically generated HTML files if the redirect location comes from an untrusted source. !NOTE This does not impact your React...

CVE-2026-36609

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding securityEncode function, this allows an attacker to reverse captured authentication...

CVE-2026-36602

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, revealing kernel memory layout and aiding further exploitation...

CVE-2026-36605

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover...

CVE-2026-36607

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

aimmo (>=0.69.9b442, <=0.69.10b450), cfl-common (>=4.30.9, <=4.30.10) +2 more potentially affected by CVE-2026-6873 via django (2.2.22)

django PYPI version 2.2.22 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.9b442, =4.30.9, =4.30.9, =4.30.10 - rapid-router 2.7.6 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-6873 via django (1.8.2)

django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-6873 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

rapid-router (>=1.0.0.post0.dev406, <=1.0.0.post0.dev408) potentially affected by CVE-2026-6873 via django (1.8.3)

django PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev406, =1.0.0.post0.dev408 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-8404 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-48587 via django (1.11.24)

django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...