@neptune.digital/sentry-netlify-v2 (1.2.1) potentially affected by CVE-2025-65944 via @sentry/aws-serverless (10.19.0)

@sentry/aws-serverless NPM version 10.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sentry/aws-serverless and may be impacted: - @neptune.digital/sentry-netlify-v2 1.2.1 Source cves: CVE-2025-65944 Source advisory: OSV:GHSA-6465-JGVQ-JHGP...

EUVD-2023-42665

Malicious code in bioql PyPI...

EUVD-2022-6760

Malicious code in bioql PyPI...

How AI-Native Development Platforms Enable Fake Captcha Pages

Cybercriminals are abusing AI-native platforms like Vercel, Netlify, and Lovable to host fake captcha pages that deceive users, bypass detection, and drive phishing campaigns...

CVE-2025-54793

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...

CVE-2025-54793 Astro: Duplicate trailing slash feature can lead to Open Redirects

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...

CVE-2025-54793 Astro: Duplicate trailing slash feature can lead to Open Redirects

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...

CVE-2025-54793 Astro: Duplicate trailing slash feature can lead to Open Redirects

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...

netlify (22.3.0), netlify-cli (>=22.2.2-pre.dd189fc, <=22.3.0) potentially affected by CVE-2025-54387 via ipx (3.0.3)

ipx NPM version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ipx and may be impacted: - netlify 22.3.0 - netlify-cli =22.2.2-pre.dd189fc, =22.3.0 Source cves: CVE-2025-54387 Source advisory: SNYK:JS-IPX-11483961...

netlify (22.3.0), netlify-cli (>=22.2.2-pre.dd189fc, <=22.3.0) potentially affected by CVE-2025-54387 via ipx (3.0.3)

ipx NPM version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ipx and may be impacted: - netlify 22.3.0 - netlify-cli =22.2.2-pre.dd189fc, =22.3.0 Source cves: CVE-2025-54387 Source advisory: OSV:GHSA-MM3P-J368-7JCR...

@mastra/deployer-netlify (>=0.0.0-a2a-20250421213654, <=0.10.5), @rr0/cms (>=0.3.23, <=0.3.29) +14 more potentially affected by CVE-2025-54387 via ipx (>=2.0.1, <=2.1.0)

ipx NPM version =2.0.1, =0.0.0-a2a-20250421213654, =0.3.23, =1.1.6, =4.0.0, =2.0.3, =0.0.23, =1.0.0, =1.0.2, =21.5.0, =17.4.0, =0.0.7, =0.0.13 - tmp-package-registry 1.0.0 and more Source cves: CVE-2025-54387 Source advisory: OSV:GHSA-MM3P-J368-7JCR...

CVE-2023-38904

A Cross Site Scripting XSS vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function...

CVE-2022-39239

netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is cached globally, this...

GHSA-7M27-7GHC-44W9 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact A Denial of Service DoS attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low...

Mozilla: Netlify Authentication Token Exposed in Public Mozilla CI Logs

A critical vulnerability was discovered involving the exposure of a Netlify authentication token within publicly accessible logs. The token provided full access to the "Mozilla IT Web SRE" Netlify account, bypassing all restrictions. The token's permissions encompassed roles such as Owner,...

GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue

User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...

CVE-2023-38904

A Cross Site Scripting XSS vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function...

CVE-2023-38904

A Cross Site Scripting XSS vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function...

Cross site scripting

A Cross Site Scripting XSS vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function...

PT-2023-26677 · Netlify · Netlify Cms

Name of the Vulnerable Software and Affected Versions: Netlify CMS version 2.10.192 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted payload to the body parameter of the new post function. Recommendations: For Netlify CMS version...