Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 28

Reset filters

Critical 09.10.2026

CVE-2026-108261

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.

High 24.07.2026

ghsa-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

High 24.07.2026

CVE-2026-55685

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

Medium 23.07.2026

CVE-2026-53669

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

Medium 23.07.2026

CVE-2026-53668

React Router: Open redirect leading to XSS

Medium 23.07.2026

CVE-2026-53667

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

Medium 23.07.2026

CVE-2026-53666

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

Low 15.06.2026

CVE-2026-53663

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

High 04.06.2026

CVE-2026-34077

React Router vulnerable to Denial of Service via reflected user input in single-fetch

High 03.06.2026

CVE-2026-42342

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

High 03.06.2026

CVE-2026-42211

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

Medium 03.06.2026

CVE-2026-40181

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

High 03.06.2026

CVE-2026-33245

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

Medium 03.06.2026

CVE-2026-33244

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

Critical Exploited in attacks 12.05.2026

CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

High 30.04.2026

CVE-2026-42349

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Medium 08.01.2026

CVE-2026-22030

React Router has CSRF issue in Action/Server Action Request Processing

High 08.01.2026

CVE-2026-22029

React Router vulnerable to XSS via Open Redirects

High 08.01.2026

CVE-2026-21884

React Router SSR XSS in ScrollRestoration

Medium 08.01.2026

CVE-2025-68470

React Router has unexpected external redirect via untrusted paths

Critical 08.01.2026

CVE-2025-61686

React Router has Path Traversal in File Session Storage

High 08.01.2026

CVE-2025-59057

React Router has XSS Vulnerability

Medium 13.11.2025

CVE-2025-64525

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

High 08.08.2025

CVE-2025-55008

The AuthKit React Router Library rendered sensitive auth data in HTML

Showing 1 to 24 of 28 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 28

Know which vulnerabilities affect your application

Application security in your inbox