GHSA-7M27-7GHC-44W9 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact A Denial of Service DoS attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56332

Next.js DoS/DoW vulnerability (CVE-2024-56332) affects Next.js deployments using Server Actions, prior to versions 13.5.8, 14.2.21, and 15.1.2. Attackers can craft requests that leave Server Actions hanging, potentially exhausting hosting resources and raising bills. The issue is mitigated by upg...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56332

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

GHSA-J386-3444-QGWG Trix allows Cross-site Scripting via `javascript:` url in a link

The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field. Impact An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute arbitrary JavaScript code within the context of the user's session,...

CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute...

CVE-2024-55896: User Interface (UI) Misrepresentation of Critical Information

IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system...

ZenML < 0.56.3 Vulnerability - CVE-2024-2383

The version of ZenML installed on the remote host is prior to 0.56.3. It is, therefore, affected by a clickjacking vulnerability due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the...

CVE-2024-56332: Allocation of Resources Without Limits or Throttling

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-37490

Cross-Site Request Forgery CSRF vulnerability in wproyal Bard bard allows Cross Site Request Forgery.This issue affects Bard: from n/a through = 2.210...

CVE-2024-38729 WordPress MBE eShip plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in MBE Worldwide S.p.A. MBE eShip allows Cross Site Request Forgery.This issue affects MBE eShip: from n/a through 2.1.2...

PT-2025-2465

Name of the Vulnerable Software and Affected Versions: Loco Translate versions n/a through 2.6.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-2481

Name of the Vulnerable Software and Affected Versions: Mesmerize versions 1.6.120 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This can be exploited by an attacker to perform actions witho...

PT-2025-2478

Name of the Vulnerable Software and Affected Versions: Coachify versions 1.0.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a...

PT-2025-2472

Name of the Vulnerable Software and Affected Versions: WP Travel Engine Travel Monster versions 1.1.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This can be exploited by tricking a user...

PT-2025-2500

Name of the Vulnerable Software and Affected Versions: The Events Calendar versions through 6.5.1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker...

PT-2025-2526

Name of the Vulnerable Software and Affected Versions: Marsian i-transform versions n/a through 3.0.9 Description: A Cross-Site Request Forgery CSRF issue affects Marsian, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited by tricking a user into...

PT-2025-2492

Name of the Vulnerable Software and Affected Versions: BlazeThemes Trendy News versions 1.0.15 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the...