Conoce las vulnerabilidades. Protege tus aplicaciones.

Crítica 09.10.2026

CVE-2026-108261

El iframe de vista previa del administrador de TinaCMS carga un origen controlado por el atacante desde el fragmento de URL

El iframe de vista previa del administrador de TinaCMS carga un origen controlado por atacantes desde el fragmento de la URL. Si un editor autenticado abre un enlace manipulado, atacantes remotos no autenticados pueden leer y escribir arbitrariamente en la API de contenido con sus privilegios.

npm

tinacms, @tinacms/app

Alta 24.07.2026

ghsa-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

npm

react-router

Alta 24.07.2026

CVE-2026-55685

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

npm

react-router

Media 23.07.2026

CVE-2026-53669

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

npm

react-router

Media 23.07.2026

CVE-2026-53668

React Router: Open redirect leading to XSS

npm

react-router, react-router-dom

Media 23.07.2026

CVE-2026-53667

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

npm

react-router

Media 23.07.2026

CVE-2026-53666

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

npm

react-router

Baja 15.06.2026

CVE-2026-53663

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

npm

react-router, @remix-run/server-runtime

Alta 04.06.2026

CVE-2026-34077

React Router vulnerable to Denial of Service via reflected user input in single-fetch

npm

react-router, turbo-stream

Alta 03.06.2026

CVE-2026-42342

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

npm

react-router, @remix-run/server-runtime

Alta 03.06.2026

CVE-2026-42211

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

npm

react-router

Media 03.06.2026

CVE-2026-40181

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

npm

react-router, @remix-run/router

Alta 03.06.2026

CVE-2026-33245

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

npm

react-router

Media 03.06.2026

CVE-2026-33244

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

npm

react-router

Crítica Explotada en ataques 12.05.2026

CVE-2026-45321

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

npm

@tanstack/arktype-adapter, @tanstack/eslint-plugin-router, @tanstack/eslint-plugin-start +39

Alta 30.04.2026

CVE-2026-42349

Clerk has an authorization bypass when combining organization, billing, or reverification checks

npm

@clerk/astro, @clerk/backend, @clerk/chrome-extension +14

Media 08.01.2026

CVE-2026-22030

React Router has CSRF issue in Action/Server Action Request Processing

npm

react-router, @remix-run/server-runtime

Alta 08.01.2026

CVE-2026-22029

React Router vulnerable to XSS via Open Redirects

npm

react-router, @remix-run/router

Alta 08.01.2026

CVE-2026-21884

React Router SSR XSS in ScrollRestoration

npm

react-router, @remix-run/react

Media 08.01.2026

CVE-2025-68470

React Router has unexpected external redirect via untrusted paths

npm

react-router

Crítica 08.01.2026

CVE-2025-61686

React Router has Path Traversal in File Session Storage

npm

@react-router/node, @remix-run/deno, @remix-run/node

Alta 08.01.2026

CVE-2025-59057

React Router has XSS Vulnerability

npm

react-router, @remix-run/react

Media 13.11.2025

CVE-2025-64525

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

npm

astro

Alta 08.08.2025

CVE-2025-55008

The AuthKit React Router Library rendered sensitive auth data in HTML

npm

@workos-inc/authkit-react-router