CVE-2026-25754

CVE-2026-25754 affects AdonisJS multipart form-data parsing (package: @adonisjs/bodyparser). The underlying issue is prototype pollution caused by insufficient validation of multipart field names during parsing, allowing manipulation of object prototypes at runtime. Affected versions are AdonisJS...

GHSA-F5X2-VJ4H-VG4C AdonisJS multipart body parsing has Prototype Pollution issue

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

PT-2026-6857

Description A Prototype Pollution vulnerability CWE-1321 in AdonisJS multipart form-data parsing may allow a remote attacker to manipulate object prototypes at runtime. This impacts @adonisjs/bodyparser through version 10.1.2 and 11.x prerelease versions prior to 11.0.0-next.8. This issue has bee...

@adonisjs/lucid 安全漏洞

@adonisjs/lucid is a database object-relational mapping library open-sourced by the AdonisJS Framework. Versions of @adonisjs/lucid before 10.1.3 and versions before 11.0.0-next.9 have security vulnerabilities. These vulnerabilities stem from prototype pollution in the parsing of multi-part form...

@adenta/cms (>=0.0.6, <=1.1.1-0), @contentql/core (>=0.1.2, <=0.3.5) +16 more potentially affected by CVE-2026-25544 via @payloadcms/next (>=3.0.0-beta.48, <=3.72.0-internal.3e70d4c)

@payloadcms/next NPM version =3.0.0-beta.48, =0.0.6, =0.1.2, =1.0.2, =0.1.0, =3.2.0, =0.2.0, =1.0.54, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =1.53.40, =1.53.45 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSNEXT-15240192...

Malicious code in @helloflex/widget-next-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ca9fce3cc7390ed9fa54426eb0404651c2679a146b83aaf537d0d4c4cf9ba2c The package @helloflex/widget-next-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-760 Malicious code in @helloflex/widget-next-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ca9fce3cc7390ed9fa54426eb0404651c2679a146b83aaf537d0d4c4cf9ba2c The package @helloflex/widget-next-sdk was found to contain malicious code. Source: ghsa-malware...

Oracle Enterprise Manager Cloud Control (January 2026 CPU)

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent...

Fedora: Security Advisory (FEDORA-2026-b31c8d8e83)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2026-d8979b7a9c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OSV-2026-170 Use-of-uninitialized-value in pcpp::PcapNgFileReaderDevice::getNextPacketInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=479882050 Crash type: Use-of-uninitialized-value Crash state: pcpp::PcapNgFileReaderDevice::getNextPacketInternal pcpp::IFileReaderDevice::getNextPackets FuzzWriter.cpp...

[SECURITY] Fedora 43 Update: bind9-next-9.21.17-1.fc43

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Fedora 43 : bind9-next (2026-b31c8d8e83)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b31c8d8e83 advisory. Update to 9.21.17 rhbz2415843 Security Fixes: - Fix incorrect length checks for BRID and HHIT records. CVE-2025-13878 New Features: - Add support for Extende...

Fedora 42 : bind9-next (2026-d8979b7a9c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d8979b7a9c advisory. Update to 9.21.17 rhbz2415843 Security Fixes: - Fix incorrect length checks for BRID and HHIT records. CVE-2025-13878 New Features: - Add support for Extende...

CVE-2025-13984

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

CVE-2025-13984

The Drupal Next.js module (specifically SA-CONTRIB-2025-122 ) contains a permissive cross-domain security policy that enables Cross-Origin Resource Sharing (CORS) with insecure default settings (Access-Control-Allow-Origin: ps *). This behavior overrides any services.yml CORS configuration, allow...

CVE-2025-13984 Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

EUVD-2025-206437

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864. A specially crafted HTTP...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +300 more potentially affected by unknown CVE via next (>=15.3.0, <=15.3.8)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...