Skip to content
Sign in

Vendor

react

Alert
No react CVE is in the CISA KEV catalogue.

Tracked since 12 Nov · latest article 12 Nov · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date

No react CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds react CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a react CVE to KEV.

Fix listed

0 of 1 CVE in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-126187: 78.4th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-12618778.4

Coverage1 article · all time

The latest article naming react, in the shared story grammar.

Full timeline
Developinglatest 9 hours ago1 article1 outlet

1 article from 1 outlet since 12 Nov. Still developing; the latest report was 9 hours ago.

Now12 NovFirst reportStepSecurity · 12 Nov, 15:30
  • Thu 12 Nov, 15:30 UTC. StepSecurity, first report. React fixes Flight flaw that enables unauthenticated code execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 1 articles as a list
  1. Thu 12 NovDay 01
    1. React fixes Flight flaw that enables unauthenticated code execution15:30 · StepSecurity · First report

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-126187

    React: Unauthenticated Remote Code Execution in React Server Components

    9.5Critical1.8% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in