tag

Nodejs

React Server Components Flight-Protocol Prototype Pollution RCE — "React2Shell" (CVE-2025-55182) KEV RW EPSS 100%

CVE-2025-55182 web Patched

CVE-2025-55182webCRITICAL 10Patched2026-07-06Mongoose `populate()` Match `$where` Bypass Command Injection (CVE-2025-23061)

CVE-2025-23061 web Patched

CVE-2025-23061webCRITICAL 9Patched2026-07-06WebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)

CVE-2026-27778 web Patched

CVE-2026-27778webMEDIUMPatched2026-07-05Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417

CVE-2026-11417 cloud Patched

CVE-2026-11417cloudHIGH 3.1Patched2026-07-05Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951

CVE-2026-30951 web Patched

CVE-2026-30951webHIGHPatched2026-07-05Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)

CVE-2026-40487 / GHSA-44wg-r34q-hvfx web Patched

CVE-2026-40487 / GHSA-44wg-r34q-hvfxwebHIGH 8.9Patched2026-07-05PolarLearn Forum Vote Count Manipulation (CVE-2026-25126)

CVE-2026-25126 web Patched

CVE-2026-25126webMEDIUMPatched2026-07-05Orval OpenAPI Codegen Arbitrary Code Execution via Malicious Spec (CVE-2026-23947)

CVE-2026-23947 misc Patched

CVE-2026-23947miscHIGHPatched2026-07-05oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)

CVE-2026-33331 (GHSA-7f6v-3gx7-27q8) web Patched

CVE-2026-33331webHIGHPatched2026-07-05npm `tar` Package Unicode-Normalization Race Condition / File Collision (CVE-2026-2395)

CVE-2026-2395 misc Unverified

CVE-2026-2395miscMEDIUMUnverified2026-07-05Node.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)

CVE-2026-41242 web Patched

CVE-2026-41242webCRITICALPatched2026-07-05Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786

CVE-2026-29786 misc Patched

CVE-2026-29786miscHIGHPatched2026-07-05node-tar Hardlink/Symlink Path Traversal Arbitrary File Overwrite (CVE-2026-23745)

CVE-2026-23745 / GHSA-8qq5-rm4j-mr97 misc Patched

CVE-2026-23745 / GHSA-8qq5-rm4j-mr97miscHIGHPatched2026-07-05Next.js Vendored picomatch Vulnerable Dependency — CVE-2026-33671

CVE-2026-33671 web Patched

CVE-2026-33671webHIGHPatched2026-07-05Multiparty Denial of Service via Prototype-Pollution Field Name (CVE-2026-8161)

CVE-2026-8161 / GHSA-qxch-whhj-8956 misc Patched

CVE-2026-8161 / GHSA-qxch-whhj-8956miscMEDIUMPatched2026-07-05Multer Orphaned Temporary File Disk-Exhaustion DoS — CVE-2026-3304

CVE-2026-3304 web Patched

CVE-2026-3304webHIGH 8.7Patched2026-07-05MikroORM Custom Type Raw SQL Injection (CVE-2026-34220)

CVE-2026-34220 web Patched

CVE-2026-34220webHIGHPatched2026-07-05Math.js Expression Parser Sandbox Bypass RCE (CVE-2026-40897)

CVE-2026-40897 web Patched

CVE-2026-40897webCRITICALPatched2026-07-05LiquidJS Template Engine Path Traversal — CVE-2026-30952

CVE-2026-30952 (GHSA-wmfp-5q7x-987x) misc Patched

CVE-2026-30952miscHIGH 8.7Patched2026-07-05HAXcms Node.js Private Key Disclosure via Broken HMAC (CVE-2026-46395)

CVE-2026-46395 web Patched

CVE-2026-46395webCRITICAL 9.8Patched2026-07-05Handlebars AST Injection Remote Code Execution — CVE-2026-33937

CVE-2026-33937 web Patched

CVE-2026-33937webCRITICALPatched2026-07-05Ghost CMS Theme JSONPath Remote Code Execution — CVE-2026-29053

CVE-2026-29053 (GHSA-cgc2-rcrh-qr5x) web Patched

CVE-2026-29053webHIGHPatched2026-07-05exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)

CVE-2026-43893 / GHSA-cw26-7653-2rp5 misc Patched

CVE-2026-43893 / GHSA-cw26-7653-2rp5miscHIGH 8.2Patched2026-07-05DbGate `loadReader` `functionName` Injection RCE (CVE-2026-48017)

CVE-2026-48017 / GHSA-hv83-ggc4-v385 web Patched

CVE-2026-48017 / GHSA-hv83-ggc4-v385webHIGH 8.8Patched2026-07-05AdonisJS bodyparser Path Traversal to Arbitrary File Write (CVE-2026-21440)

CVE-2026-21440 (GHSA-gvq6-hvvp-h34h) web Patched

CVE-2026-21440webCRITICAL 9.2Patched2026-07-05NodeBB ActivityPub attributedTo Local UID Spoof

None assigned as of 2026-07-03 web Unverified

None assigned as of 2026-07-03webHIGHUnverified2026-07-03