GHSA-4JQV-MC3X-M676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Self-hosted Next.js applications that use the Pages Router with statically generated SSG or incrementally regenerated ISR pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is...

EUVD-2026-91670

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications...

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

NPM: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass vulnerability discovered by ? in WordPress Npm next versions = 16.0.0, 16.3.8...

GHSA-F87G-XV8R-7P7X Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams...

Security Bulletin:React Router Open Redirect and XSS Vulnerability Fixed in 7.13.0

Summary React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This...

Security Bulletin:React Router SSR Error Handling Vulnerability in Versions 6.4.0 to 7.17.0

Summary React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, apollo-router, sccache, shadowsocks-rust, komodo, ntpd-rs, vector...

CVE-2026-16528

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS...

CVE-2026-19386

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

EUVD-2026-94159

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-14911

A Cross-site Scripting (XSS) vulnerability exists in ASUS router modules due to the improper neutralization of input during web page generation. A remote attacker can exploit this flaw by tricking an authenticated user into visiting a crafted URL. Successful exploitation may allow the attacker to...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-19386

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...

CVE-2026-19386

A stack-based buffer overflow exists in ASUS router modules , which allows an authenticated nearby user to execute arbitrary code . This vulnerability is triggered by uploading a crafted configuration file that exceeds the expected buffer size. For specific details on affected versions and remedi...

EUVD-2026-94157

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...

CVE-2026-19386

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for...