CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

CVE-2025-48985

The CVE-2025-48985 vulnerability affects Vercel’s AI SDK, with fixes in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. The issue is an input-validation bypass that could allow bypassing filetype whitelists during file uploads. Connected sources confirm remediation via upgrading the AI SDK. Impact...

CVE-2025-48985: Improper Input Validation

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details:...

PT-2025-45397

Name of the Vulnerable Software and Affected Versions Vercel AI SDK versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta Description A flaw exists in Vercel’s AI SDK that could allow users to bypass filetype whitelists during file uploads. This bypass could potentially lead to unauthorized file uploads...

AI SDK security vulnerabilities

AI SDK is a TypeScript AI toolkit open-sourced by Vercel. A security vulnerability exists in AI SDK versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta, which stems from the possibility that a user could bypass the file type whitelist to upload a file...

PT-2025-45770

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade...

Exploit for Improper Authorization in Vercel Next.Js

CVEs — Exploits/CVE Identifiers Repository A collection of pr...

Malware in vercel-v0

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview vercel-v0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in vercel-v0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b3f5d72ec9c31838366e2e5e38f08021d40aa495b4424e97ff5b580a24467d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48091 Malicious code in vercel-v0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b3f5d72ec9c31838366e2e5e38f08021d40aa495b4424e97ff5b580a24467d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-20103

Malicious code in bioql PyPI...

EUVD-2023-0571

Malicious code in bioql PyPI...

EUVD-2025-19911

Malicious code in bioql PyPI...

EUVD-2022-6640

Malicious code in bioql PyPI...

How AI-Native Development Platforms Enable Fake Captcha Pages

Cybercriminals are abusing AI-native platforms like Vercel, Netlify, and Lovable to host fake captcha pages that deceive users, bypass detection, and drive phishing campaigns...

Exploit for Incorrect Authorization in Vercel Next.Js

CVE-2025-29927 Research and Safe Testing Framework This repos...

Linux Distros Unpatched Vulnerability : CVE-2017-20162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The...

Linux Distros Unpatched Vulnerability : CVE-2025-49005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, ...

CVE-2025-54793

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...