Dec 3, 2025
2 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js
A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.
React Server Components (react-server-dom-*), Next.jsClosed Dec 12, 2025
- ClosedHighPatched
OpenPLC ScadaBR: ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Added to CISA KEV on 2025-12-03.
OpenPLC ScadaBRClosed Dec 3, 2025
