Poznaj podatności. Chroń swoje aplikacje.

Krytyczna 09.10.2026

CVE-2026-108261

Ramka podglądu panelu administracyjnego TinaCMS ładuje pochodzenie kontrolowane przez atakującego z fragmentu URL

Ramka podglądu panelu TinaCMS ładuje pochodzenie kontrolowane przez atakującego z fragmentu URL. Jeśli zalogowany edytor otworzy spreparowany link, nieautoryzowany atakujący może uzyskać pełny dostęp do odczytu i zapisu w API treści witryny w jego kontekście.

npm

tinacms, @tinacms/app

Wysoka 24.07.2026

ghsa-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

npm

react-router

Wysoka 24.07.2026

CVE-2026-55685

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

npm

react-router

Średnia 23.07.2026

CVE-2026-53669

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

npm

react-router

Średnia 23.07.2026

CVE-2026-53668

React Router: Open redirect leading to XSS

npm

react-router, react-router-dom

Średnia 23.07.2026

CVE-2026-53667

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

npm

react-router

Średnia 23.07.2026

CVE-2026-53666

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

npm

react-router

Niska 15.06.2026

CVE-2026-53663

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

npm

react-router, @remix-run/server-runtime

Wysoka 04.06.2026

CVE-2026-34077

React Router vulnerable to Denial of Service via reflected user input in single-fetch

npm

react-router, turbo-stream

Wysoka 03.06.2026

CVE-2026-42342

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

npm

react-router, @remix-run/server-runtime

Wysoka 03.06.2026

CVE-2026-42211

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

npm

react-router

Średnia 03.06.2026

CVE-2026-40181

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

npm

react-router, @remix-run/router

Wysoka 03.06.2026

CVE-2026-33245

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

npm

react-router

Średnia 03.06.2026

CVE-2026-33244

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

npm

react-router

Krytyczna Wykorzystywana w atakach 12.05.2026

CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

npm

@tanstack/arktype-adapter, @tanstack/eslint-plugin-router, @tanstack/eslint-plugin-start +39

Wysoka 30.04.2026

CVE-2026-42349

Clerk has an authorization bypass when combining organization, billing, or reverification checks

npm

@clerk/astro, @clerk/backend, @clerk/chrome-extension +14

Średnia 08.01.2026

CVE-2026-22030

React Router has CSRF issue in Action/Server Action Request Processing

npm

react-router, @remix-run/server-runtime

Wysoka 08.01.2026

CVE-2026-22029

React Router vulnerable to XSS via Open Redirects

npm

react-router, @remix-run/router

Wysoka 08.01.2026

CVE-2026-21884

React Router SSR XSS in ScrollRestoration

npm

react-router, @remix-run/react

Średnia 08.01.2026

CVE-2025-68470

React Router has unexpected external redirect via untrusted paths

npm

react-router

Krytyczna 08.01.2026

CVE-2025-61686

React Router has Path Traversal in File Session Storage

npm

@react-router/node, @remix-run/deno, @remix-run/node

Wysoka 08.01.2026

CVE-2025-59057

React Router has XSS Vulnerability

npm

react-router, @remix-run/react

Średnia 13.11.2025

CVE-2025-64525

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

npm

astro

Wysoka 08.08.2025

CVE-2025-55008

The AuthKit React Router Library rendered sensitive auth data in HTML

npm

@workos-inc/authkit-react-router