Orca Research Pod

Orca Security 'O' logomark
Featured

React and Next.js Vulnerabilities Enable Remote Code Execution

A critical vulnerability was announced today affecting React Server Components (RSC), which affects React (CVE-2025-55182) and all frameworks using RSC, notably Next.js (CVE-2025-66478). Both vulnerabilities were given a CVSSv3 10.0 score, marking them as highly critical. The source of these vulnerabilities was found in RSC’s ReactFlight protocol – a protocol used by React 19 to …

  • December 03, 2025
  • By Tohar Braun

Latest

All Latest

Explore

Discovered Vulnerabilities

Image of a red container with clouds

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

This week, three new high-severity vulnerabilities were revealed in runC, the fundamental runtime technology used by most container platforms. This impacts major systems such as Docker, containerd, Kubernetes, and virtually all managed Kubernetes services offered by major cloud providers. These vulnerabilities combined allow for a container escape, where a malicious factor can break out of …

  • November 10, 2025
  • By Shir Sadon
A stylized graphic of the word CVE Alert next to a broken cog

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

  • October 26, 2025
A stylized graphic of a pull request from GitHub with a hole in it and data leaking out

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

  • September 30, 2025
A stylized graphic showing a pull request window with malicious code

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

  • September 24, 2025
A stylized graphic of floating packages in a dark cloud background

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

  • September 16, 2025
All Discovered Vulnerabilities

‘Orca Watch’ Series

All ‘Orca Watch’ Series

Technical Deep Dives

All Technical Deep Dives

Thought Leadership

All Thought Leadership

In the News

All In the News

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Get the report