Vulnerabilities
Last updated 1 hour ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
next
|
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up | High Risk 7.5 | 5 months ago | 8 hours ago |
|
@seggy116/next-diff
|
Malicious code in @seggy116/next-diff (npm) | Unknown | 12 days ago | 5 days ago |
|
i18next-http-backend
|
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string | Low Risk 3.7 | 6 days ago | 6 days ago |
|
i18next-http-backend
|
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) | Low Risk 3.1 | 6 days ago | 6 days ago |
cargo-nextest
|
Arbitrary code execution when rerunning tests from a portable recording | High Risk 7.8 | 9 days ago | 8 days ago |
|
i18next-http-backend
|
i18next-http-backend incomplete URL validation permits SSRF | Low Risk 3.7 | 28 days ago | 11 days ago |
|
next
|
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays | Critical 9.5 | 12 days ago | 12 days ago |
|
next
|
next.js cache leak across root param values in nested 'use cache' functions | Medium Risk 6.0 | 12 days ago | 12 days ago |
|
next
|
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | Critical 9.5 | 12 days ago | 12 days ago |
|
@sentry/nextjs
|
Sentry-Javascript: Middleware Bypass when using Tunnel route | Critical 9.5 | 12 days ago | 12 days ago |
|
next
|
Next.js: Denial of Service in App Router using Server Actions | High Risk 8.0 | 12 days ago | 12 days ago |
|
@opennextjs/cloudflare
|
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths | High Risk 7.5 | 19 days ago | 19 days ago |
|
next
|
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages | Medium Risk 4.2 | 27 days ago | 27 days ago |
|
next
|
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | Medium Risk 5.3 | 27 days ago | 27 days ago |
|
next
|
Next.js has Server-Side Request Forgery in Image Optimization | Medium Risk 6.5 | 27 days ago | 27 days ago |
|
next
|
Next.js has information disclosure in development server's Model Context Protocol endpoint | Medium Risk 5.4 | 27 days ago | 27 days ago |
|
next
|
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass | Medium Risk 5.3 | 27 days ago | 27 days ago |
|
next
|
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | Medium Risk 4.8 | 27 days ago | 27 days ago |
|
@payloadcms/next
|
Payload: Untrusted redirect URL parameter exploit | Medium Risk 6.1 | 28 days ago | 28 days ago |
|
next
|
Next.js: Remote Code Execution in next/og ImageResponse | Critical 9.5 | 1 month ago | 1 month ago |
|
@client-web-next/ab-landing-form
|
Malicious code in @client-web-next/ab-landing-form (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/analytics
|
Malicious code in @client-web-next/analytics (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/navigation-link
|
Malicious code in @client-web-next/navigation-link (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/api-metrics
|
Malicious code in @client-web-next/api-metrics (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/event-bus-listener
|
Malicious code in @client-web-next/event-bus-listener (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/adaptive
|
Malicious code in @client-web-next/adaptive (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/env-util
|
Malicious code in @client-web-next/env-util (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/icons
|
Malicious code in @client-web-next/icons (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/tarjeta-button
|
Malicious code in @client-web-next/tarjeta-button (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/timer
|
Malicious code in @client-web-next/timer (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/ua-parser
|
Malicious code in @client-web-next/ua-parser (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/ui
|
Malicious code in @client-web-next/ui (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/ui-business
|
Malicious code in @client-web-next/ui-business (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/ab-tests
|
Malicious code in @client-web-next/ab-tests (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/feature-flags
|
Malicious code in @client-web-next/feature-flags (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/providers
|
Malicious code in @client-web-next/providers (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/transfer-state
|
Malicious code in @client-web-next/transfer-state (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/utils
|
Malicious code in @client-web-next/utils (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/cms
|
Malicious code in @client-web-next/cms (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/footer
|
Malicious code in @client-web-next/footer (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/logger
|
Malicious code in @client-web-next/logger (npm) | Unknown | 1 month ago | 1 month ago |
|
@client-web-next/origination-microfront
|
Malicious code in @client-web-next/origination-microfront (npm) | Unknown | 1 month ago | 1 month ago |
|
nextjsupdater
|
Malicious code in nextjsupdater (npm) | Unknown | 2 months ago | 1 month ago |
|
next-tinacms-azure
|
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site | High Risk 8.8 | 1 month ago | 1 month ago |
nextcloud-mcp-server
|
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) | Critical 9.1 | 2 months ago | 1 month ago |
|
nextcloud-mcp-server
|
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) | Critical 9.1 | 1 month ago | 1 month ago |
|
next-auth
|
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers | High Risk 7.5 | 3 months ago | 1 month ago |
|
next
|
Next.js: Unauthenticated disclosure of internal Server Function endpoints | Medium Risk 6.0 | 3 months ago | 1 month ago |
|
next
|
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname | High Risk 8.0 | 3 months ago | 1 month ago |
|
next
|
Next.js: Cache confusion of response bodies for requests with bodies | Medium Risk 6.0 | 3 months ago | 1 month ago |
Page 1