9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +105 more potentially affected by CVE-2025-59471 +1 more via next (>=16.1.1, <=16.1.4)

next NPM version =16.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-59471, CVE-2025-59472 Source advisory: SNYK:JS-NEXT-15105315...

CVE-2025-59471

A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint /next/image loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause...

@071yoon/log-console-core (0.1.0), @3bitmt/3bit-sidebar-dashboard (1.2.0) +202 more potentially affected by CVE-2025-55184 +1 more via next (>=16.0.0, <=16.0.10)

next NPM version =16.0.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =1.0.4144, =1.0.4257, =1.0.4257, =1.0.4556 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +129 more potentially affected by CVE-2025-55184 +1 more via next (>=15.4.0-canary.17, <=15.4.10)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =0.1.0, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =0.0.3 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +306 more potentially affected by CVE-2025-55184 +1 more via next (>=15.1.0, <=15.1.11)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +300 more potentially affected by CVE-2025-55184 +1 more via next (>=15.3.0, <=15.3.8)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

9remote (>=0.1.0, <=0.1.8), @alecpapierniak/mcp-manager (>=0.1.0, <=0.1.2) +115 more potentially affected by CVE-2025-55184 +1 more via next (>=16.1.0, <=16.1.4)

next NPM version =16.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =1.0.8, =0.3.0, =0.0.0-canary-20260113162409, =1.53.0 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by CVE-2025-55184 +1 more via next (>=15.2.0, <=15.2.8)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55184, CVE-2026-238...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +209 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exceptions, or excessive CPU usage by sending...

CVE-2026-24358

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

Exploit for Deserialization of Untrusted Data in Facebook React

🔍 Next.js Security Testing Tool Professiona...

CVE-2026-24358

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

CVE-2026-24358

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

PT-2026-43786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Real-Time RT load balancing mechanism where a CPU can enter an infinite self-Inter-Processor Interrupt IPI loop, leading to a CPU hardlockup. This occurs when a CP...

PT-2026-4254

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

Azure Linux 3.0 Security Update: kernel (CVE-2024-57892)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-57892 advisory. - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to...

Azure Linux 3.0 Security Update: kernel (CVE-2024-56703)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56703 advisory. - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6selectpath...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251218024537, <=0.7.7-next.1), @backstage/backend-test-utils (>=1.10.1-next.0, <=1.10.2-next.1) +14 more potentially affected by CVE-2026-24046 via @backstage/backend-defaults (0.14.0-next.1)

@backstage/backend-defaults NPM version 0.14.0-next.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/backend-defaults and may be impacted: - @backstage/backend-dynamic-feature-service =0.0.0-nightly-20251218024537, =1.10.1-next.0,...

CVE-2026-1144 quickjs-ng quickjs Atomics Ops quickjs.c use after free

A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is...