https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:48:10.811417+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-15156 bdu:2025-15156 2026-10-03T07:48:10.901447+00:00 bdu:2025-15156 https://cve.radiocsirt.org/vuln/certfr-2025-ale-014 certfr-2025-ale-014 — **<span class="important-content">[Mise à jour du 11 décembre 2025]</span>** Le CERT-FR a connaissance de multiples ex… 2026-10-03T07:48:10.901487+00:00 certfr-2025-ale-014 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1131 certfr-2025-avi-1131 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T07:48:10.901514+00:00 certfr-2025-avi-1131 https://cve.radiocsirt.org/vuln/cisco-sa-react-flight-tyw32ddb cisco-sa-react-flight-TYw32Ddb — Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025 2026-10-03T07:48:10.901529+00:00

On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system. For a description of this vulnerability, see the public React Security Advisory ["https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"]. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.

 https://cve.radiocsirt.org/vuln/cnvd-2025-29924 cnvd-2025-29924 2026-10-03T07:48:10.901582+00:00 cnvd-2025-29924 https://cve.radiocsirt.org/vuln/euvd-2026-344008 EUVD-2026-344008 2026-10-03T07:48:10.901610+00:00 EUVD-2026-344008 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55182 fkie_cve-2025-55182 2026-10-03T07:48:10.901620+00:00

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

 https://cve.radiocsirt.org/vuln/ghsa-fv66-9v8q-g76r GHSA-fv66-9v8q-g76r — React Server Components are Vulnerable to RCE 2026-10-03T07:48:10.901642+00:00

Affected: npm: react-server-dom-webpack, npm: react-server-dom-turbopack, npm: react-server-dom-parcel

### Impact

There is an unauthenticated remote code execution vulnerability in React Server Components.

We recommend upgrading immediately.

The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)

### Patches

A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.

If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.

### References

See the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2738 WID-SEC-W-2025-2738 — Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung 2026-10-03T07:48:10.901690+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.