11 matches found
CVE-2026-64644
A flaw was found in Next.js, a React framework. When self-hosting Next.js with the default image loader and configured to optimize remotely hosted images, a remote attacker could exploit the Image Optimization API. By providing malicious images, the attacker can cause CPU exhaustion, leading to a...
CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...
CVE-2026-64644
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...
PYSEC-2026-1312 DockerSpawner allows any image by default
Impact Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. Patches Upgrade to DockerSpawner 13...
EUVD-2026-39463
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls throu...
CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...
CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could...
CVE-2025-58179
Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...
PT-2023-30774
Name of the Vulnerable Software and Affected Versions DockerSpawner versions 0.11.0 through 12 Description The issue affects JupyterHub deployments running DockerSpawner, allowing users to launch any pullable Docker image instead of restricting to the single configured image. This has been...
WordPress plugin ProfilePress 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin ProfilePress 4.5.0...