CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4336 matches found

OSV•added 2026/03/17 4:17 p.m.•8 views

GHSA-3X4C-7XQ6-9PQ8 Next.js: Unbounded next/image disk cache growth can exhaust storage

Summary The default Next.js image optimization disk cache /next/image did not have a configurable upper bound, allowing unbounded cache growth. Impact An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impa...

6.9CVSS5.9AI score0.00841EPSS

SaveExploits0References5

Snyk•added 2026/03/17 4:17 p.m.•29 views

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of an upper bound on the disk cache used by the image optimization. An attacker can exhaust disk storage by generating a large number of...

7.5CVSS5.8AI score0.00841EPSS

SaveExploits0References2

vulnersOsv•added 2026/03/17 4:17 p.m.•10 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +533 more potentially affected by CVE-2026-27980 via next (>=16.0.0, <=16.1.6)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-27980 Source advisory:...

7.5CVSS5.8AI score0.00841EPSS

SaveExploits0

Github Security Blog•added 2026/03/17 4:16 p.m.•24 views

Next.js: Unbounded postponed resume buffering can lead to DoS

Summary A request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments...

7.5CVSS7.3AI score0.00841EPSS

SaveExploits0References5Affected Software1

OSV•added 2026/03/17 4:16 p.m.•6 views

GHSA-H27X-G6W4-24GQ Next.js: Unbounded postponed resume buffering can lead to DoS

6.9CVSS6AI score0.00841EPSS

SaveExploits0References5

vulnersOsv•added 2026/03/17 4:16 p.m.•6 views

9remote (>=0.1.0, <=0.1.8), @0xchain/auth (>=1.1.0-beta.8, <=1.1.0-beta.18) +353 more potentially affected by CVE-2026-27979 via next (>=16.1.0, <=16.1.6)

next NPM version =16.1.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-27979...

7.5CVSS7.2AI score0.00841EPSS

SaveExploits0

vulnersOsv•added 2026/03/17 4:16 p.m.•11 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +509 more potentially affected by CVE-2026-27979 via next (>=16.0.1, <=16.1.6)

next NPM version =16.0.1, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-27979 Source advisory:...

7.5CVSS7.2AI score0.00841EPSS

SaveExploits0

vulnersOsv•added 2026/03/17 3:30 p.m.•7 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +509 more potentially affected by CVE-2026-27978 via next (>=16.0.1, <=16.1.6)

5.3CVSS5.5AI score0.00226EPSS

SaveExploits1

vulnersOsv•added 2026/03/17 3:30 p.m.•7 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +509 more potentially affected by CVE-2026-27978 via next (>=16.0.1, <=16.1.6)

5.3CVSS5.5AI score0.00226EPSS

SaveExploits1

Snyk•added 2026/03/17 3:30 p.m.•18 views

Cross-site Request Forgery (CSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the uncaught origin: null in the Server Action CSRF validation. An attacker can perform unauthorized state-changing actions on behalf of a user by inducing the user's...

5.3CVSS5.6AI score0.00226EPSS

SaveExploits1References2

vulnersOsv•added 2026/03/17 3:29 p.m.•7 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +509 more potentially affected by CVE-2026-27977 via next (>=16.0.1, <=16.1.6)

5.4CVSS6AI score0.00211EPSS

SaveExploits1

vulnersOsv•added 2026/03/17 3:29 p.m.•9 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +509 more potentially affected by CVE-2026-27977 via next (>=16.0.1, <=16.1.6)

5.4CVSS6AI score0.00211EPSS

SaveExploits1

Snyk•added 2026/03/17 3:29 p.m.•53 views

Missing Origin Validation in WebSockets

Overview next is a react framework. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets in the internal dev endpoint when the Origin header is set to null. An attacker can interact with internal development websocket traffic by connecting from...

5.4CVSS5.8AI score0.00211EPSS

SaveExploits1References2

Positive Technologies•added 2026/03/17 12:00 a.m.•20 views

PT-2026-36470

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system during the inactivation of an inode with node-format extended attributes. The function xfs attr3 node inactive invalidates child leaf or node block...

4.7CVSS5.8AI score0.00098EPSS

SaveExploits0

Tenable Nessus•added 2026/03/17 12:00 a.m.•15 views

EulerOS Virtualization 2.12.0 : python3 (EulerOS-SA-2026-1512)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorit...

9.4CVSS7.3AI score0.01631EPSS

SaveExploits14References14

Positive Technologies•added 2026/03/17 12:00 a.m.•29 views

PT-2026-25969

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.1 through 16.1.6 Description Next.js, a React framework for building full-stack web applications, is affected by an issue where requests containing the next-resume: 1 header can lead to excessive memory usage and potentia...

7.8CVSS7.2AI score0.00841EPSS

SaveExploits0References15

Snyk•added 2026/03/16 6:55 p.m.•12 views

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the recvMessageloop validation path in fsm.go. An attacker can crash the GoBGP process by sending a BGP UPDATE whose NEXTHOP attribute reports a length shorter than 4 while the...

8.7CVSS5.8AI score0.00547EPSS

SaveExploits1References2

EUVD•added 2026/03/16 6:32 p.m.•21 views

EUVD-2026-12466

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXTHOP path attribute...

5.9AI score0.00547EPSS

SaveExploits1References2

Github Security Blog•added 2026/03/16 6:32 p.m.•20 views

GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXTHOP path attribute...

7.5CVSS8AI score0.00547EPSS

SaveExploits1References5Affected Software1

OSV•added 2026/03/16 6:32 p.m.•20 views

GHSA-4P9M-8GC4-RW2H GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXTHOP path attribute...

7.5CVSS8AI score0.00547EPSS

SaveExploits1References5

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by