4334 matches found
DRUPAL-CONTRIB-2025-122
This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...
Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
A maximum-severity security flaw has been disclosed in React Server Components RSC that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows...
47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by CVE-2025-55182 +1 more via next (>=15.5.0, <=15.5.6)
next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...
@071yoon/log-console-core (0.1.0), @adarshanatia/init-web (>=1.0.0, <=1.0.1) +122 more potentially affected by CVE-2025-55182 +1 more via next (>=16.0.0, <=16.0.6)
next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =1.0.0, =0.1.0, =0.0.152, =0.1.33, =1.7.4, =1.9.5 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...
3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +299 more potentially affected by CVE-2025-55182 +1 more via next (>=15.1.0, <=15.1.8)
next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...
@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +210 more potentially affected by CVE-2025-55182 +1 more via next (>=15.2.0, <=15.2.5)
next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55182, CVE-2025-664...
-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +294 more potentially affected by CVE-2025-55182 +1 more via next (>=15.3.0, <=15.3.5)
next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...
@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +122 more potentially affected by CVE-2025-55182 +1 more via next (>=15.4.0-canary.17, <=15.4.7)
next NPM version =15.4.0-canary.17, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.1.1, =0.1.7, =0.1.8 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...
Next.js - Critical - Access bypass - SA-CONTRIB-2025-122
This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...
ERPNext和Frappe Technologies Frappe Framework 安全漏洞
Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India.ERPNext is a suite of open-source Enterprise Resource Planning ERP solution. A security vulnerability exists in ERPNext version v15.83.2 an...
Security Bulletin: IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752.
Summary IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-55173 DESCRIPTION: Next.js is a React framework for building full-stack...
PT-2026-2503
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ocfs2 subsystem, specifically in the ocfs2 find victim chain function. A kernel BUG occurs when the cl next free rec field within the allocati...
Exploit for Race Condition in Vercel Next.Js
CVE-2025-32421---Race-Condition-Vulnerability---Next.js PoC La...
Malicious code in next-styled-nprogress (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73288a3937c0b6e5fe20c011142795ae2f436252a77e2ab6b24dabcdb9ab7dd5 The package next-styled-nprogress was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-199062
Malicious code in next-styled-nprogress npm...
MAL-2025-190981 Malicious code in next-styled-nprogress (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73288a3937c0b6e5fe20c011142795ae2f436252a77e2ab6b24dabcdb9ab7dd5 The package next-styled-nprogress was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190980 Malicious code in next-simple-google-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c0df29a06f4738e26d90f0418c197f39ad60e98981f43cff7baaa82a672ced The package next-simple-google-analytics was found to contain malicious code. Source: ghsa-malware...
Malicious code in next-simple-google-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c0df29a06f4738e26d90f0418c197f39ad60e98981f43cff7baaa82a672ced The package next-simple-google-analytics was found to contain malicious code. Source: ghsa-malware...
Malicious code in next-circular-dependency (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea89df6bfd2c4f68a23ce84ab344f8d0581b90cfbf4c6e0a82570797b5cffc0 The package next-circular-dependency was found to contain malicious code. Source: ghsa-malware...