PT-2025-36997

Name of the Vulnerable Software and Affected Versions: PyInstaller versions prior to 6.0.0 Description: PyInstaller packages Python applications and their dependencies into a single package. A specially crafted entry appended to sys.path during the bootstrap process of a PyInstaller-frozen...

Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)

Summary There is a vulnerability in Apache Commons FileUpload which affects IBM WebSphere Application Server traditional and affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. Following IBM® Engineering...

kernel: padata: fix UAF in padata_reorder

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the padatareorder function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure pd is decremented in one thread, freeing it, while another thread still...

Linux Distros Unpatched Vulnerability : CVE-2021-30470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray, PdfTokenizer::GetNextVariant and PdfTokenizer::ReadDataType...

Linux Distros Unpatched Vulnerability : CVE-2023-25361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. CVE-2023-25361 Note...

CVE-2025-57822

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1056 more potentially affected by CVE-2025-57752 via next (>=15.0.0, <=15.4.1)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57752 Source advisory:...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the image optimization process, when responses from API routes vary based on request headers such as Cookie or Authorization. An attacker can gain unauthorized...

@adenta/cms (>=0.0.6, <=1.1.1-0), @edrlab/thorium-web (>=1.0.0-beta.3, <=1.0.0-beta.8) +18 more potentially affected by CVE-2025-57752 via next (>=15.4.3, <=15.4.4)

next NPM version =15.4.3, =0.0.6, =1.0.0-beta.3, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =2.1.5, =2.1.21 and more Source cves: CVE-2025-57752 Source advisory: SNYK:JS-NEXT-12301496...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1084 more potentially affected by CVE-2025-57752 via next (>=15.0.0, <=15.4.4)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57752 Source advisory:...

Missing Source Correlation of Multiple Independent Data

Overview next is a react framework. Affected versions of this package are vulnerable to Missing Source Correlation of Multiple Independent Data in image-optimizer. An attacker can cause arbitrary files to be downloaded with attacker-controlled content and filenames by supplying malicious external...

@adenta/cms (>=0.0.6, <=1.1.1-0), @edrlab/thorium-web (>=1.0.0-beta.3, <=1.0.0-beta.8) +18 more potentially affected by CVE-2025-55173 via next (>=15.4.3, <=15.4.4)

next NPM version =15.4.3, =0.0.6, =1.0.0-beta.3, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =2.1.5, =2.1.21 and more Source cves: CVE-2025-55173 Source advisory: SNYK:JS-NEXT-12265451...

CVE-2025-57822

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolve-routes. An attacker can access internal resources and potentially exfiltrate sensitive information by crafting requests containing user-controlled headers e.g.,...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1056 more potentially affected by CVE-2025-57822 via next (>=15.0.0, <=15.4.1)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57822 Source advisory:...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1142 more potentially affected by CVE-2025-57822 via next (>=15.0.0, <=15.4.6)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =1.5.0-beta.1, =0.1.0, =0.1.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =0.0.5-alpha-20250505070314-fe37055a9f31a5579df0224dd5a16cce090d542b and more Source cves: CVE-2025-57822 Source advisory:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @cognizant-ai-lab/ui-common (>=1.2.4-main.7f918ee.29, <=1.3.3) +82 more potentially affected by CVE-2025-57822 via next (>=15.4.3, <=15.4.6)

next NPM version =15.4.3, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.1, =1.1.0, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.1 - @madraka/nextjs-videoplayer 1.0.4 - @misikirayu/nextjs-blog-cms 1.0.0 and more Source cves: CVE-2025-57822 Source advisory: SNYK:JS-NEXT-12299318...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +9 more potentially affected by CVE-2025-4644 via @payloadcms/next (>=3.0.0-beta.48, <=3.43.0-internal.693bd81)

@payloadcms/next NPM version =3.0.0-beta.48, =0.1.2, =0.1.0, =3.2.0, =0.2.0, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4644 Source advisory: OSV:GHSA-26RV-H2HF-3FW4...

PT-2025-35327

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.31 Next.js versions 15.0.0 through 15.4.5 Description Next.js Image Optimization API routes are susceptible to a cache key confusion issue. When images returned from API routes vary based on request headers, such...

PT-2025-35322

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.32 and prior to 15.4.7 Description Next.js is a React framework for building full-stack web applications. When the next function was used without explicitly passing the request object in self-hosted applications,...