CVE-2025-55182

CVE-2025-55182 Proof of concept for a Remote Code Execution RCE vulnerability in React Server Functions Next.js, etc.. Exploits prototype pollution to execute arbitrary code on the server without authentication. Warning : This repository is for educational and research purposes only. Unauthorized...

CVE-2025-55182

CVE-2025-55182 React2Shell Analysis Report Sections required by the assignment guidelines are marked with “Required”. 1. Environment Required 1.1. Dockerfile Required This environment uses a custom Dockerfile based on the official Node.js Alpine image. FROM node:20-alpine WORKDIR /app COPY...

CVE-2025-55182

CVE-2025-55182 — React Server Components Unauthenticated RCE Severity: Critical — CVSS 10.0 CWE: CWE-502 Deserialization of Untrusted Data Vendor: Meta Facebook Disclosed: December 3, 2025 Overview CVE-2025-55182 is a maximum-severity unauthenticated remote code execution RCE vulnerability in Rea...

react2shell-poc-CVE-2025-55182

React2Shell PoC CVE-2025-55182 A Proof-of-Concept PoC script for React2Shell CVE-2025-55182, a critical remote code execution RCE vulnerability affecting Next.js applications using Server Actions. !WARNING Disclaimer : This tool is for educational and authorized testing purposes only. I am not...

CVE-2025-55182

CVE-2025-55182: React Server Components Unsafe Deserialization Vulnerability Overview CVE-2025-55182 also known as React2Shell is a critical unsafe deserialization vulnerability discovered in the React Flight Protocol, affecting the payload of React Server Components RSC. This vulnerability resid...

PoC_CVE-2025-55182

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

cve-2025-55182-mitigator

cve-2025-55182-mitigator Defensive scanner + mitigation guidance for CVE-2025-55182 React Server Components / Flight protocol insecure deserialization. This tool is intended to help you: identify repos that are likely vulnerable based on dependency versions quickly apply the definitive mitigation...

react2shell-audit

React2Shell Audit CVE-2025-55182 React2Shell Audit is a lightweight, recursive Bash script designed to detect local Next.js and React Server DOM installations vulnerable to CVE-2025-55182 React2Shell and CVE-2025-66478. 🚨 The Vulnerability React2Shell is a critical remote code execution RCE...

React2Shell

React2Shell 📌 React2Shell CVE-2025-55182 React2Shell is the informal name given to a critical Remote Code Execution RCE vulnerability affecting React Server Components RSC and related frameworks like Next.js. Its severity and potential impact have made it a major concern in the web development an...

React2ShellPoC

Understanding CVE-2025-55182 React2Shell: A Deep Dive into Remote Code Execution via React Server Components Overview CVE-2025-55182, also known as React2Shell , is a critical remote code execution RCE vulnerability affecting React Server Components. This flaw enables unauthenticated attackers to...

EUVD-2026-89108

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102808 PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sdstress command where the -b byte count parameter is parsed without validation before being passed to malloc and memset. Attackers with shell access, including through MAVLink, can supply invalid byte count...

CVE-2026-102809 PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...

CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: afunix: Fixed a data race around unixtotinflight. unixtotinflight is updated under spinlockunixgclock, but unixreleasesock reads it without locking. We will use READONCE for unixtotinflight...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: powermate – fixed a use-after-free in powermateconfigComplete. Syzbot has identified a use-after-free bug 1 in the powermate driver. This occurs when the device is disconnected, causing memory data related to the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bonding: Fix for xfrm realdev null pointer dereference We should not set realdev to NULL, because packets may still be in transit, and xfrm might call xdodevoffloadok in parallel. All callbacks assume that realdev is set. Example...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Do not keep the queue frozen during system suspension. The commit 4ce6e2db00de “virtio-blk: Ensure no requests are in the virtqueues before deleting the vqs.” replaces “queue quiesce” with “queue freeze” in virtio-blk...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: cifs: Fixed a mid leak that occurred during reconnection after a timeout threshold. When the number of responses with the status STATUSIOTIMEOUT exceeds a specified threshold NUMSTATUSIOTIMEOUT, we reconnect the connection...