755 matches found
CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
EUVD-2026-74189
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-84685
The react-native-auth0 SDK 's web platform implementation fails to scope its in-memory token cache to individual user sessions in server-side rendering (SSR) environments where module state persists across HTTP requests. As a result, tokens cached in module memory can be retrieved by subsequent r...
MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...
Malicious code in krdpass-auth-react-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...
PT-2026-88449
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
CVE-2026-84685: Exposure of Data Element to Wrong Session
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...
ROOT-APP-NPM-CVE-2024-25466 CVE-2024-25466 in react-native-document-picker - Patched by Root
Root has patched CVE-2024-25466 in the react-native-document-picker package for Root:npm. Multiple fixed versions available...
Malicious code in amplitude-react-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...
MAL-2026-15525 Malicious code in amplitude-react-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...
MAL-2026-13495 Malicious code in blekit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...
Malicious code in react-native-ui-message (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...
Malicious code in @qlik/react-native-simple-grid (npm)
npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)
npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...
CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...
CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...
CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...
CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...
CVE-2026-18648: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...