4340 matches found
ROOT-APP-NPM-AIKIDO-2026-553733 AIKIDO-2026-553733 in next - Patched by Root
Root has patched AIKIDO-2026-553733 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10754 AIKIDO-2026-10754 in next - Patched by Root
Root has patched AIKIDO-2026-10754 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-34351 CVE-2024-34351 in next - Patched by Root
Root has patched CVE-2024-34351 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-MWV6-3258-Q52C GHSA-mwv6-3258-q52c in next - Patched by Root
Root has patched GHSA-mwv6-3258-q52c in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10762 AIKIDO-2026-10762 in next - Patched by Root
Root has patched AIKIDO-2026-10762 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10758 AIKIDO-2026-10758 in next - Patched by Root
Root has patched AIKIDO-2026-10758 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-29927 CVE-2025-29927 in next - Patched by Root
Root has patched CVE-2025-29927 in the next package for Root:npm. Multiple fixed versions available...
PT-2026-97045
Name of the Vulnerable Software and Affected Versions Next.js versions 16.2.0 through 16.3.5 Description A flaw in the Node.js implementation of the ImageResponse component within the next/og package occurs due to improper encoding or escaping of output data. This issue arises when...
CVE-2026-91165
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...
CVE-2026-58491
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
EUVD-2026-84063
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...
CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
CVE-2026-58491
Warpgate (an open-source SSH, HTTPS, and MySQL bastion host for Linux) prior to 0.25.5 is vulnerable to reflected XSS and open redirect in its SSO return endpoint. The root cause is an attacker-controlled next parameter stored at /@warpgate/api/sso/providers/:name/start and inserted without HTML ...
EUVD-2026-84059
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
CVE-2026-58491 Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by...
quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...
quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...