Next.js Framework 16.x < 16.2.11 Middleware Bypass

The Next.js Framework on the remote host is affected by an authentication bypass vulnerability: - Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. CVE-2026-64642 Note...

Open Redirect

React Router is vulnerable to Open Redirect. The vulnerability is due to improper handling of backslashes in and useNavigate, allowing attackers to bypass redirect validation and redirect users to attacker-controlled websites...

Denial Of Service

Next.js is vulnerable to Denial Of Service. The vulnerability is due to improper handling of crafted requests targeting applications using the App Router with Server Actions, allowing attackers to trigger excessive CPU usage and block processing of further requests...

Denial Of Service

React Router is vulnerable to Denial Of Service. The vulnerability is due to insufficient protection of the manifest endpoint, where unauthenticated targeted requests can generate excessive server load, allowing attackers to degrade application performance and slow response times...

Denial Of Service (DoS)

Next.js is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of requests targeting App Router applications with Server Actions running on the Edge runtime, allowing attackers to trigger excessive memory consumption and degrade application availability...

GHSA-3WP3-XXJ9-5JQQ Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the unstable RSC APIs. An attacker can execute unauthorized actions by tricking a user into submitting crafted requests. Note: This is only exploitable if the unstable RSC APIs are enabled in the...

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...

GHSA-QWWW-VCR4-C8H2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. !NOTE This only affects your application if you are using the unstable RSC APIs...

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through inefficient route matching in the manifest endpoint. An attacker can cause excessive server load and degrade response times by sending unauthenticated targeted requests. Note: This is only...

GHSA-CHX6-HX7R-MCP5 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response...

NPM: React Router: Unauthenticated Denial of Service via Inefficient Route Matching

NPM: React Router: Unauthenticated Denial of Service via Inefficient Route Matching vulnerability discovered by ? in WordPress Npm react-router versions = 7.0.0, 7.18.0...

EUVD-2026-48523

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

CVE-2026-15704 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

CVE-2026-15704

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

CVE-2026-15704

Eclipse BaSyx Go Components up to 1.0.0 are vulnerable to an ABAC authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router uses Chi’s StripSlashes, so a request like GET /shells/ may be dispatched to GET /shells, while ...

PT-2026-64256

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

CVE-2026-63313

9Router before 0.4.72 is affected by a server-side request forgery (SSRF) in the /v1/web/fetch endpoint. The endpoint accepts a user-supplied url and passes it to an external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa). Validation only checks syntactic correctness via new URL(), wi...

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...