CVE & Exploit Intelligence Database

CVE-2025-55182 10.0 CRITICAL KEV RANSOMWARE 473 PoCs Analysis NUCLEI EPSS 0.70

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CWE-502 Dec 03, 2025

CVE-2025-11953 9.8 CRITICAL KEV 6 PoCs Analysis EPSS 0.03

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

CWE-78 Nov 03, 2025

CVE-2025-54313 7.5 HIGH KEV 2 PoCs Analysis EPSS 0.07

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

CWE-506 Jul 19, 2025

CVE-2025-31125 5.3 MEDIUM KEV 6 PoCs Analysis NUCLEI EPSS 0.78

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CWE-284 Mar 31, 2025

CVE-2023-5217 8.8 HIGH KEV 4 PoCs Analysis EPSS 0.04

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CWE-787 Sep 28, 2023

CVE-2023-4863 8.8 HIGH KEV 10 PoCs Analysis EPSS 0.94

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CWE-787 Sep 12, 2023

CVE-2022-4135 9.6 CRITICAL KEV EPSS 0.00

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CWE-787 Nov 25, 2022

CVE-2021-21315 7.1 HIGH KEV 6 PoCs Analysis NUCLEI EPSS 0.94

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CWE-78 Feb 16, 2021

CVE-2020-11023 6.9 MEDIUM KEV 7 PoCs Analysis EPSS 0.36

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CWE-79 Apr 29, 2020

CVE-2019-10758 9.9 CRITICAL KEV 2 PoCs Analysis NUCLEI EPSS 0.94

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

CWE-94 Dec 24, 2019

CVE-2019-5786 6.5 MEDIUM KEV 3 PoCs Analysis EPSS 0.89

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CWE-416 Jun 27, 2019