638 matches found
CVE-2026-107369
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
EUVD-2026-100481
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
CVE-2026-107369
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
CVE-2026-107369
The auth0/nextjs-auth0 SDK contains an open redirect vulnerability due to improper validation of the returnTo parameter. While the SDK initially validates that the parameter is a same-origin URL, the subsequent reconstruction logic can produce a URL that browsers interpret as an absolute or schem...
CVE-2026-107369: URL Redirection to Untrusted Site
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
PT-2026-113365
šØ CVE-2026-107369 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or...
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
EUVD-2026-92430
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
CVE-2026-92931: Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
PT-2026-105993
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...
@novu/nextjs (>=3.0.0-canary.0, <=3.17.0), @novu/react (>=3.0.0-canary.0, <=3.17.0) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.0)
@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.0 Source cves: CVE-2026-75510 Source advisory: GHSA-8GR3-5J6F-25GP...
@novu/nextjs (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d), @novu/react (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d)
@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: OSV:GHSA-8GR3-5J6F-25GP...
@apolitical/component-library (>=8.3.5-ac.0, <=8.3.18-beta.0), @novu/nextjs (>=2.5.0, <=3.17.1-rc.1-rc.da35e9062d) +2 more potentially affected by CVE-2026-75510 via @novu/js (>=2.6.3, <=3.17.1-rc.1-rc.da35e9062d)
@novu/js NPM version =2.6.3, =8.3.5-ac.0, =2.5.0, =2.0.0-alpha.0, =2.2.0-rc.2, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: MEND:CVE-2026-75510...
ROOT-APP-NPM-CVE-2025-57822 CVE-2025-57822 in next - Patched by Root
Root has patched CVE-2025-57822 in the next package for Root:npm. Multiple fixed versions available...