PT-2026-70816

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description Stored Cross-Site Scripting XSS occurs due to insufficient protection of the web...

WordPress ShareOpenly Cross-Site Script Vulnerability

WordPress ShareOpenly is an open-source social sharing plugin designed specifically for WordPress. It aims to replace outdated traditional sharing buttons. WordPress ShareOpenly has a cross-site scripting vulnerability, which stems from the $url variable in the sharing link being output before th...

PT-2026-70086

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description Insufficient validation of saved graph configuration data allows a malicious user to store a crafted svgIcon value. Since these configurations can be viewed by other users or...

CVE-2026-66771: Improper Neutralization of Input During Web Page Generation

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

EUVD-2026-55848

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

CVE-2026-48161 affects react18-use (a React 19 use hook shim). Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits that added src/install.js and wired it into postinstall, which fetched a JavaScript payload from an attacker-controlled HTTPS endpoint...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160

CVE-2026-48160 (react-tracked) describes malicious commits on the default branch that, during npm install, could execute attacker-controlled code on developer machines. The window between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 included commits 6978272a7d6ca02225cb747ea69f427512e33699 through...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

EUVD-2026-55836

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

EUVD-2026-55797

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch...

CVE-2026-48159 use-reducer-async was vulnerable to malicious code execution via compromised commits

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

CVE-2026-48159 use-reducer-async was vulnerable to malicious code execution via compromised commits

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...