Browse CVEs

HIGH 7.5 CVE-2026-55685 React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests t… React Router 7.18.0+ Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-53668 React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable… React Router 7.13.0+ Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-53667 React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects fro… React Router 7.18.0+ Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-53669 React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNaviga… React Router 7.18.0+ Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-53666 React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to… React Router 7.18.0+ Fix from $1,6002026-07-27 HIGH 8.1 CVE-2026-42211 React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unaut… React Router 7.14.2+ Fix from $1,9502026-06-02 HIGH 7.5 CVE-2026-42342 React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime,… React Router 2.17.5 / 7.15.0+ Fix from $1,9502026-06-02 MEDIUM 6.1 CVE-2026-40181 React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigg… React Router 6.30.4 / 7.14.1+ Fix from $1,6002026-06-02 HIGH 7.5 CVE-2026-34077 React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is… React Router 3.0.0 / 7.14.0+ Fix from $1,9502026-06-02 MEDIUM 5.4 CVE-2026-33244 React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization o… React Router 7.13.2+ Fix from $1,6002026-06-02 HIGH 8.8 CVE-2026-39862 Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhos… Tophat 2.5.1+ Fix from $1,9502026-04-08 CRITICAL 9.8 CVE-2026-34060 Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rub… Ruby Lsp 0.10.2 / 0.26.9+ Fix from $2,3002026-03-31 MEDIUM 6.5 CVE-2026-22030 React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Rem… React Router 2.17.3+ Fix from $1,6002026-01-10 CRITICAL 9.1 CVE-2025-61686EPSS 16% React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node … React Router\/node 2.17.2 / 7.9.4+ Fix from $2,3002026-01-10 HIGH 8.2 CVE-2026-21884 React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in… React Router 2.17.3+ Fix from $1,9502026-01-10 HIGH 7.6 CVE-2025-59057 React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerab… React Router after 7.8.2 Fix from $1,9502026-01-10 MEDIUM 6.5 CVE-2025-68470 React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a… React Router after 7.9.5 Fix from $1,6002026-01-10 MEDIUM 6.1 CVE-2026-22029 React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2… Remix Run\/react 1.23.2+ Fix from $1,6002026-01-10 MEDIUM 5.4 CVE-2022-29230 Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnera… Hydrogen 0.19.0+ Fix from $1,6002022-05-18 MEDIUM 6.1 CVE-2020-8176 A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` paramet… Koa Shopify Auth Patch available Fix from $1,6002020-07-02