PT-2026-136930

A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Such documents are corrupt and should not be opened. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

Node.js 26.12.0 ZipFile Invalid-Header Content Substitution

Node.js versions before 26.12.1 in the 26.x branch contain a ZipFile invalid-header content substitution flaw that can return attacker-controlled prefix bytes after failed ZIP header validation. This tool evaluates operator-supplied Node.js version evidence offline...

Node.js 26.12.0 ZipFile Invalid-Header Content Substitution

Node.js version 26.x prior to 26.12.1 contains a ZipFile invalid-header content-substitution issue when an untrusted ZIP file is processed after property modification or compaction...

Exploit for CVE-2026-106070

node-cve-2026-106070-check Standalon...

CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...

EUVD-2026-91674

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service...

GHSA-MCJ8-R9MP-W47P Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

NPM: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service vulnerability discovered by ? in WordPress Npm next versions = 15.0.0, 15.5.27...

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request...

CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request t...

CVE-2026-94484

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...

CVE-2026-94484

The Next.js React framework is vulnerable to cache poisoning in versions 15.0.0 through 15.5.27 and 16.3.8 . The root cause is an insufficiently scoped shared response cache key used by applications with a root-level catch-all page and statically generated or Incremental Static Regeneration (ISR)...

PT-2026-104376

Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions prior to 16.3.8 Description Applications using a root-level catch-all page and statically generated or Incremental Static Regeneration ISR routes use a shared response cache key that is...

Linux Distros Unpatched Vulnerability : CVE-2026-94484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and...

CVE-2026-94484: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the...