CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4290 matches found

vulnersOsv•added 2026/05/11 3:56 p.m.•8 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44579 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44579 Source advisory:...

7.5CVSS7.2AI score0.00764EPSS

SaveExploits1

Snyk•added 2026/05/11 3:55 p.m.•26 views

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via crafted WebSocket upgrade requests. An attacker can access internal or external resources by sending specially crafted requests with absolute-url that cause the server to...

8.6CVSS7.8AI score0.01895EPSS

SaveExploits11References2

vulnersOsv•added 2026/05/11 3:55 p.m.•10 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44578 via next (>=16.0.0, <=16.2.4)

8.6CVSS7.6AI score0.01895EPSS

SaveExploits11

vulnersOsv•added 2026/05/11 3:54 p.m.•17 views

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 03-gs-ee-6 (0.3.5) +40667 more potentially affected by CVE-2026-44576 via next (>=14.2.0, <=15.5.15)

next NPM version =14.2.0, =0.1.0, =1.0.0, =0.1.0, =1.1.4 - 21guns 1.1.2 - 2bv2 1.4.8 and more Source cves: CVE-2026-44576 Source advisory: OSV:GHSA-WFC6-R584-VFW7...

5.4CVSS5.8AI score0.00304EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 3:54 p.m.•11 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44576 via next (>=16.0.0, <=16.2.4)

5.4CVSS5.8AI score0.00304EPSS

SaveExploits0

Github Security Blog•added 2026/05/11 3:54 p.m.•33 views

Next.js vulnerable to cache poisoning in React Server Component responses

Impact Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later...

5.4CVSS5.8AI score0.00304EPSS

SaveExploits0References5Affected Software1

Snyk•added 2026/05/11 3:54 p.m.•42 views

Interpretation Conflict

Overview next is a react framework. Affected versions of this package are vulnerable to Interpretation Conflict via improper handling of shared cache entries for React Server Component responses. An attacker can cause unintended component payloads to be served to other users by manipulating share...

6.3CVSS5.7AI score0.00304EPSS

SaveExploits0References2

Snyk•added 2026/05/11 3:54 p.m.•33 views

Authentication Bypass Using an Alternate Path or Channel

Overview next is a react framework. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the handling of segment-prefetch routes. An attacker can gain unauthorized access to protected content by crafting .rsc and segment-prefetch URLs tha...

8.7CVSS7.1AI score0.00761EPSS

SaveExploits0References2

vulnersOsv•added 2026/05/11 3:54 p.m.•10 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44575 via next (>=16.0.0, <=16.2.4)

7.5CVSS7.2AI score0.00761EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 3:54 p.m.•9 views

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +846 more potentially affected by CVE-2026-44575 via next (>=15.2.0, <=15.5.15)

next NPM version =15.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-44575 Source advisory: OSV:GHSA-267C-6GRR-H53F...

7.5CVSS7.2AI score0.00761EPSS

SaveExploits0

OSV•added 2026/05/11 3:54 p.m.•10 views

GHSA-492V-C6PP-MQQV Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Impact Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected conte...

8.1CVSS7.3AI score0.00667EPSS

SaveExploits2References5

vulnersOsv•added 2026/05/11 3:54 p.m.•9 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44574 via next (>=16.0.0, <=16.2.4)

8.1CVSS7.4AI score0.00667EPSS

SaveExploits2

vulnersOsv•added 2026/05/11 3:54 p.m.•9 views

3d-effect-cinema (>=0.1.0, <=0.4.1), 47th (0.1.0) +354 more potentially affected by CVE-2026-44574 via next (>=15.4.0-canary.17, <=15.5.15)

next NPM version =15.4.0-canary.17, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-44574 Source advisory: SNYK:JS-NEXT-16638679...

8.1CVSS7.4AI score0.00667EPSS

SaveExploits2

vulnersOsv•added 2026/05/11 3:53 p.m.•7 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by CVE-2026-44573 via next (>=16.0.0, <=16.2.4)

7.5CVSS7.2AI score0.00761EPSS

SaveExploits1

Snyk•added 2026/05/11 3:18 p.m.•14 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the handling of PDUSessionResourceSetupResponse messages carrying AMF-UE-NGAP-ID. An attacker can redirect downlink user-plane traffic for any targeted UE to their own radio by sending a forged message with a...

7.1CVSS7.9AI score0.00269EPSS

SaveExploits0References3

vulnersOsv•added 2026/05/11 2:50 p.m.•8 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +784 more potentially affected by unknown CVE via next (>=16.0.0, <=16.2.4)

5.8AI score

SaveExploits0

RedhatCVE•added 2026/05/09 2:21 a.m.•23 views

CVE-2025-63706

NPM package next-npm-version1.0.1 is vulnerable to Command injection...

9.8CVSS5.8AI score0.01523EPSS

SaveExploits0References1

Positive Technologies•added 2026/05/09 12:00 a.m.•32 views

PT-2026-39417

Name of the Vulnerable Software and Affected Versions Next.js versions 12.2.0 through 15.5.15 Next.js versions 16.0.0 through 16.2.4 Description An external client can send an x-nextjs-data header on a request to a path handled by middleware that returns a redirect. This causes the middleware or...

5.9CVSS5.6AI score0.00203EPSS

SaveExploits0References16

NVD•added 2026/05/08 2:16 p.m.•45 views

CVE-2026-43298

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip vcn poison irq release on VF VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid call trace during deinitialization. 71.913601 drm clean up the vf2pf work item 71.915088 ------------ cut here...

5.5CVSS0.0016EPSS

SaveExploits0References3

OSV•added 2026/05/08 1:31 p.m.•22 views

CVE-2026-43329 netfilter: flowtable: strictly check for maximum number of actions

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: ethernet mangling 4 payload actions, 2 for each ethernet address SNAT 4 payload actions DNAT ...

7.8CVSS5.8AI score

SaveExploits0References43

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by