Schwachstellen verstehen. Anwendungen schützen.

Kritisch 09.10.2026

CVE-2026-108261

TinaCMS: Admin-Vorschau-iFrame lädt angreifergesteuerte Herkunft aus dem URL-Fragment

In TinaCMS lädt das Admin-Vorschau-iFrame eine vom Angreifer kontrollierte Herkunft aus dem URL-Fragment. Wenn ein angemeldeter Redakteur einen präparierten Link öffnet, können nicht authentifizierte Remote-Angreifer über die Content-API beliebige Lese- und Schreiboperationen mit dessen Rechten ausführen.

npm

tinacms, @tinacms/app

Hoch 24.07.2026

ghsa-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

npm

react-router

Hoch 24.07.2026

CVE-2026-55685

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

npm

react-router

Mittel 23.07.2026

CVE-2026-53669

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

npm

react-router

Mittel 23.07.2026

CVE-2026-53668

React Router: Open redirect leading to XSS

npm

react-router, react-router-dom

Mittel 23.07.2026

CVE-2026-53667

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

npm

react-router

Mittel 23.07.2026

CVE-2026-53666

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

npm

react-router

Niedrig 15.06.2026

CVE-2026-53663

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

npm

react-router, @remix-run/server-runtime

Hoch 04.06.2026

CVE-2026-34077

React Router vulnerable to Denial of Service via reflected user input in single-fetch

npm

react-router, turbo-stream

Hoch 03.06.2026

CVE-2026-42342

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

npm

react-router, @remix-run/server-runtime

Hoch 03.06.2026

CVE-2026-42211

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

npm

react-router

Mittel 03.06.2026

CVE-2026-40181

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

npm

react-router, @remix-run/router

Hoch 03.06.2026

CVE-2026-33245

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

npm

react-router

Mittel 03.06.2026

CVE-2026-33244

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

npm

react-router

Kritisch In Angriffen ausgenutzt 12.05.2026

CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

npm

@tanstack/arktype-adapter, @tanstack/eslint-plugin-router, @tanstack/eslint-plugin-start +39

Hoch 30.04.2026

CVE-2026-42349

Clerk has an authorization bypass when combining organization, billing, or reverification checks

npm

@clerk/astro, @clerk/backend, @clerk/chrome-extension +14

Mittel 08.01.2026

CVE-2026-22030

React Router has CSRF issue in Action/Server Action Request Processing

npm

react-router, @remix-run/server-runtime

Hoch 08.01.2026

CVE-2026-22029

React Router vulnerable to XSS via Open Redirects

npm

react-router, @remix-run/router

Hoch 08.01.2026

CVE-2026-21884

React Router SSR XSS in ScrollRestoration

npm

react-router, @remix-run/react

Mittel 08.01.2026

CVE-2025-68470

React Router has unexpected external redirect via untrusted paths

npm

react-router

Kritisch 08.01.2026

CVE-2025-61686

React Router has Path Traversal in File Session Storage

npm

@react-router/node, @remix-run/deno, @remix-run/node

Hoch 08.01.2026

CVE-2025-59057

React Router has XSS Vulnerability

npm

react-router, @remix-run/react

Mittel 13.11.2025

CVE-2025-64525

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

npm

astro

Hoch 08.08.2025

CVE-2025-55008

The AuthKit React Router Library rendered sensitive auth data in HTML

npm

@workos-inc/authkit-react-router