Rocky Linux 10.1 [CIQ] Security Update: mysql8.4 / mysql8.4-common / mysql8.4-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23008)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523008 advisory. mysql: DML unspecified vulnerability CPU Oct 2025 CVE-2025-53053 mysql: InnoDB unspecified vulnerability CPU Oct 2025 CVE-2025-53044 mysql: InnoDB...

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...

CVE-2025-55182

CVE-2025-55182 - Explotación de RCE en React Server Components Exploit de CLI en Python para CVE-2025-55182, una vulnerabilidad crítica de RCE en React Server Components a través de react-server-dom-webpack. Basado en: ejpir/CVE-2025-55182-poc Inicio Rápido Pruebas con Docker Unpack src.zip zip -...

CVE-2026-12944

CVE-2026-12944: Langflow 1.10.0 — SSRF mediante urllib Langflow OSS ≤ 1.10.0 — vulnerabilidad que permite la ejecución de código arbitrario mediante urllib.request / socket en componentes personalizados. La lista de denegación del escáner de componentes no incluía estos módulos de la biblioteca...

NextJS-app-CVE-2025-55182

Next.js CVE-2025-55182 概念验证 这是 Next.js 应用程序的概念验证，受到 CVE-2025-55182 （也称为 "React2Shell"）的影响，这是一个 React 服务器组件中的严重远程代码执行（RCE）漏洞。 ⚠️ 警告 此应用程序故意包含漏洞，仅应用于： 安全研究 教育目的 在隔离环境中测试 不要： 部署到生产环境 暴露给不受信任的网络 与敏感数据一起使用 漏洞详情 CVE-2025-55182 影响： React 版本 19.0.0 到 19.2.0 Next.js 版本 15.x 和 16.x（使用 App Router） 使用 React...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using...

r2s

R2S - Escáner React2Shell Un escáner de vulnerabilidades basado en web para CVE-2025-55182 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en React Server Components. Escáner en vivo: https://r2s.mxm0z.com Acerca de CVE-2025-55182 CVE-2025-55182 es una vulnerabilidad crítica CVSS...

react-CVE-2025-55182-fixer

React Server Components 安全 PR 自动化 此仓库提供了一个脚本，用于自动升级并创建拉取请求 PR ，以修复受 CVE-2025-55182 影响的仓库。该漏洞影响易受攻击版本的 react-server-dom- 及相关的 React 包。 这个工具有什么用？ 扫描仓库 package.json 中受影响的 react-server-dom-、react、react-dom 和 next 版本。 如有必要，将其升级到安全的修复版本。 在目标仓库中创建一个包含更新依赖项的 PR。 支持直接仓库和 fork。 为什么需要这个？ React Server...

nextjs-rce-incident-response

Next.js RCE 事件响应 — CVE-2025-55182 类型： 生产环境实时事件响应 漏洞： CVE-2025-55182 — React Server Components 不安全反序列化（RCE） 受影响系统： Next.js 前端 + 远程生产服务器 角色： 网络安全实习生 — SenseLive Technologies 日期： 2026年2月24–26日 事发经过 一次同步攻击同时针对前端应用和远程生产服务器。攻击利用了 CVE-2025-55182，这是 React Server Components RSC Flight 协议中的一个严重的未认证 RCE...

React-site-CVE-2025-55182

React Site - CVE-2025-55182 README: Proyecto Next.js vulnerable landing React RSC Este repositorio contiene un ejemplo de un landing corporativo multi-página en Next.js 15.0.0 + React 19.0.0. El sitio simula una estructura como t1.ru: inicio, productos, casos, medios, sobre la empresa, contacto...

CVE-2025-55182

CVE-2025-55182 Aplicación Vulnerable Construir y ejecutar: docker compose build docker compose run --rm --entrypoint 'npm install' node docker compose run --rm --entrypoint 'npm run build' node docker compose up POC de https://github.com/msanft/CVE-2025-55182: node poc.js Experimentación con...

react2shell-burp

Escáner y validador de RCE React2Shell CVE-2025-55182 Creador: j0lt Colaborador: https://github.com/shashank18 Una extensión de Burp Suite que detecta y valida la vulnerabilidad React2Shell CVE-2025-55182 — un fallo de ejecución remota de código sin autenticación previa en React Server Components...

R2S_CVE-2025-55182

CVE-2025-55182 扫描器 用于 CVE-2025-55182 的漏洞扫描器 - Next.js 服务器操作中的远程代码执行。 关于 CVE-2025-55182 严重性: 严重 CVSS 待定 受影响版本: Next.js: 15.x 15.5.7, 16.0.x 16.0.7 React: 19.0.0, 19.1.0, 19.1.1, 19.2.0 影响: 远程攻击者可以在运行易受攻击的 Next.js 应用（启用了服务器操作）的服务器上执行任意代码。该漏洞源于 React 服务器组件协议中对原型污染的不当处理。 修复版本: Next.js: ≥15.5.7 或...

cve-2025-55182-lab

CVE-2025-55182 RSC lab（有意存在漏洞） 用于授权安全研究的本地 Docker 实验环境：React Server Components / Next.js App Router ，其技术栈处于 CVE-2025-55182 （React2Shell）受影响版本范围内。 仅限在您自己的机器上使用。请勿将此容器暴露在互联网上。 参考资料 React——React Server Components 中的严重安全漏洞 NVD——CVE-2025-55182 Next.js 安全公告（适用于您发布版本的升级路径） 此实验环境运行的内容 组件| 版本| 说明...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783345013)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783345013 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739

GitLab CE/EE versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable to a Cross-site Scripting (XSS) issue. The root cause is the improper sanitization of path components within the merge request diff viewer . This flaw could allow an authenticated user to exe...

CVE-2026-100609

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609

The Flowise npm packages (flowise and flowise-components) versions through 3.1.4 are vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to filter credential lookups by the requesting user's workspaceId when querying by ID. This flaw affects several code paths, including...