67 matches found
CVE-2017-17215
CVE-2017-17215 Usage: CVE-2017-12149.py http://targetip:37215/ I am so poor that cant afford to but a HUAWEI router XD so it is not tested on any machine but the exp technically should be working I found this report...
CVE-2026-94545-nextjs-og-poc
CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection GHSA-vcvr-r3jv-pc5j Security-research material for reproducing and validating CVE-2026-94545 , the Next.js ImageResponse SVG-serialization injection upstream: Satori GHSA-wx4j-mvgx-mqwp, in an isolated, loopback-only lab. Affected:...
Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE
The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability. Satori does not properly escape certain values before including them in generated SVG output, whi...
CVE-2026-94545
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...
CVE-2026-94545 Satori-generated SVG has improper escaping
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
CVE-2026-94545
The Satori library (used by Next.js to convert HTML/CSS to SVG) fails to properly escape certain values, such as the ; character, before including them in generated SVG output. This improper output encoding (CWE-116) allows crafted values to be interpreted as SVG markup. When Next.js (versions 16...
CVE-2026-94545 Satori-generated SVG has improper escaping
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
EUVD-2026-89994
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
@a11ywatch/web (>=0.5.5, <=0.5.212), @abtnode/blocklet-services (>=1.16.15-beta-103b95c0, <=1.17.13-beta-20260613-094425-b81920c8) +597 more potentially affected by CVE-2026-94545 via satori (>=0.0.27, <=0.33.4)
satori NPM version =0.0.27, =0.5.5, =1.16.15-beta-103b95c0, =1.16.15-beta-103b95c0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.203, =0.1.0, =1.0.1, =1.0.1, =1.0.20, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.5 and more Source cves: CVE-2026-94545 Source advisory:...
Improper Encoding or Escaping of Output
Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og allows unauthorized remote c...
CVE-2026-94545: Improper Encoding or Escaping of Output
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
Exploit for CVE-2026-94545
CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection...
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said. The risk applies when an app puts values an attacker controls, such as text read from the request URL, into...
Analyzing the Mirai IoT Botnet and Its Recent Variants: Satori, Mukashi, Moobot, and Sonic
Mirai is undoubtedly one of the most significant Internet of Things IoT botnet attacks in history. In terms of its detrimental effects, seamless spread, and low detection rate, it surpassed its predecessors. Its developers released the source code, which triggered the development of several...
Linux Distros Unpatched Vulnerability : CVE-2021-29499
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New produce predictable UUID identifier...
Replace satori/go.uuid dependency
...
GHSA-33M6-Q9V5-62R7 go.uuid has Predictable UUID Identifiers
CVE Description for go.uuid A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker. Updat...