PT-2026-30388

Breaking CyberSecurity News For 2026.04.04 | Pithy Cyborg | Threats. Breaches. Intel. ➔ Google patched CVE-2026-5281, a use-after-free bug in Dawn WebGPU, marking the fourth Chrome zero-day exploited in the wild this year. Affected versions were updated to 146.0.7680.177/178 for Windows, macOS, a...

Payload 跨站请求伪造漏洞

Payload is a headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Versions of Payload prior to 3.79.1 contained a cross-site request forgeing vulnerability. This vulnerability arises from the cross-site request forgeing protection in the authentication...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell CVE-2025-55182 POC High Fidelity Detection & Expl...

Exploit for Deserialization of Untrusted Data in Facebook React

No d...

-react-file-list-components (1.1.1), 00ld8nuivn (2.1.0) +44961 more potentially affected by CVE-2026-34043 via serialize-javascript (>=5.0.0, <=7.0.4)

serialize-javascript NPM version =5.0.0, =0.1.0, =0.1.9 - 01dk01majk 2.1.0 - 02.aula 1.0.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su 2.1.0 - 06dre15t8r 2.1.0 - 06p998toez 0.1.0 - 07fgapmu9l 1.1.0 - 07t2xvu6t4 2.1.0 and more Source cves: CVE-2026-3404...

Malicious Package

Overview react-card-security-code is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview react-expiry-date is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2215 Malicious code in react-leaflet-marker-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b37a04b363c4392e401d85320c748dab98c13ff46c74624f21aaa70091b8ae6 The package react-leaflet-marker-layer was found to contain malicious code. Source: google-open-source-security...

Malicious code in react-leaflet-marker-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b37a04b363c4392e401d85320c748dab98c13ff46c74624f21aaa70091b8ae6 The package react-leaflet-marker-layer was found to contain malicious code. Source: google-open-source-security...

MAL-2026-2214 Malicious code in react-autolink-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 402f7d8c6db956de1c20cce1c23b9d2585a9210f6aae7859acb956fb66728010 The package react-autolink-text was found to contain malicious code. Source: google-open-source-security...

Malicious code in react-autolink-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 402f7d8c6db956de1c20cce1c23b9d2585a9210f6aae7859acb956fb66728010 The package react-autolink-text was found to contain malicious code. Source: google-open-source-security...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 RSC lab intentionally vulnerable Local Doc...

MAL-2026-2159 Malicious code in @eric-orderbuddyinfo/react-noval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5f280b7537acc7eb9e1d8c12acdd2142bb02e391be55b2157ed90eb2044d06 The package @eric-orderbuddyinfo/react-noval was found to contain malicious code. Source: ghsa-malware...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in React (CVE-2018-6341)

Summary A vulnerability in React that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2018-6341 DESCRIPTION: React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack...

Malicious code in react-native-forter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff4ae821a2636c10a3e19afaaf78823613bcedf143d91c79cbdec29f20b00654 The package react-native-forter was found to contain malicious code...

MAL-2026-2386 Malicious code in react-native-forter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff4ae821a2636c10a3e19afaaf78823613bcedf143d91c79cbdec29f20b00654 The package react-native-forter was found to contain malicious code...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell-PoC-C...

MAL-2026-2136 Malicious code in yelp-react-component-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027bbca928c4c1696f388fbb2ac0ac3a7c74a29db1a6bb76b5c7431759c27421 The package yelp-react-component-rating was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview yelp-react-component-photo-upload is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in yelp-react-component-photo-upload (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32e7f0c90df117fd4748129db7ebb37ee6519a0f8ace68bbd197b8f6658da7ee The package yelp-react-component-photo-upload was found to contain malicious code. Source: ghsa-malware...