https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:49:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-15156 bdu:2025-15156 https://cve.radiocsirt.org/vuln/bdu:2025-15156 https://cve.radiocsirt.org/vuln/certfr-2025-ale-014 certfr-2025-ale-014 https://cve.radiocsirt.org/vuln/certfr-2025-ale-014 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1131 certfr-2025-avi-1131 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1131 https://cve.radiocsirt.org/vuln/cisco-sa-react-flight-tyw32ddb <p>On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system. For a description of this vulnerability, see the public React Security Advisory [&#34;https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components&#34;]. Cisco&#39;s standard practice is to update integrated third-party software components to later versions as they become available.</p> <p>On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system. For a description of this vulnerability, see the public React Security Advisory [&#34;https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components&#34;]. Cisco&#39;s standard practice is to update integrated third-party software components to later versions as they become available.</p> https://cve.radiocsirt.org/vuln/cisco-sa-react-flight-tyw32ddb https://cve.radiocsirt.org/vuln/cnvd-2025-29924 cnvd-2025-29924 https://cve.radiocsirt.org/vuln/cnvd-2025-29924 https://cve.radiocsirt.org/vuln/euvd-2026-344008 EUVD-2026-344008 https://cve.radiocsirt.org/vuln/euvd-2026-344008 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55182 <p>A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.</p> <p>A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55182 https://cve.radiocsirt.org/vuln/ghsa-fv66-9v8q-g76r <p><strong>Affected:</strong> npm: react-server-dom-webpack, npm: react-server-dom-turbopack, npm: react-server-dom-parcel</p> <p>### Impact</p> <p>There is an unauthenticated remote code execution vulnerability in React Server Components.</p> <p>We recommend upgrading immediately.</p> <p>The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)</p> <p>### Patches</p> <p>A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.</p> <p>If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.</p> <p>### References</p> <p>See the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.</p> <p><strong>Affected:</strong> npm: react-server-dom-webpack, npm: react-server-dom-turbopack, npm: react-server-dom-parcel</p> <p>### Impact</p> <p>There is an unauthenticated remote code execution vulnerability in React Server Components.</p> <p>We recommend upgrading immediately.</p> <p>The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of: * [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack) * [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel) * [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)</p> <p>### Patches</p> <p>A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.</p> <p>If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.</p> <p>### References</p> <p>See the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.</p> https://cve.radiocsirt.org/vuln/ghsa-fv66-9v8q-g76r https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2738 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js und React ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2738