3940 matches found
EUVD-2026-90872
Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...
React-Next-Scanner
React-Next-Scanner Safe CLI scanner for CVE-2025-55182 and CVE-2025-66478 This tool provides a lightweight, non-exploitative vulnerability scanner focused on modern JavaScript stacks, specifically: API services affected by CVE-2025-55182 Next.js applications affected by CVE-2025-66478 It works on...
nexts-cve-2025-66478-exploit
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...
cve-2024-3435
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...
CVE-2025-55182
CVE-2025-55182 Nextjs POC A small repository containing: test-app/: a Next.js 16 React 19 test application using the App Router. exploit.js: a local proof-of-concept script used to demonstrate and test server behavior around multipart/Next-Action handling. Intended for local testing only...
CVE-2026-103004: Use of Cache Containing Sensitive Information
Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...
PT-2026-103896
Name of the Vulnerable Software and Affected Versions Next.js versions 16.3.0 through 16.3.7 Description When Cache Components are enabled via cacheComponents: true, use cache handlers using next/root-params may leak return values to pages with different root parameters. This occurs when a use...
CVE-2026-51867
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...
Exploit for Use After Free in Linux Linux_Kernel
Root My Galaxy Payloads — Galaxy S25 Ultra SM-S938N This re...
Exploit for Use After Free in Linux Linux_Kernel
Root My Galaxy Payloads — Galaxy S25 Ultra SM-S938N This re...
Exploit for Use After Free in Linux Linux_Kernel
Root My Galaxy Payloads — Galaxy S25 Ultra SM-S938N This re...
Server-side Request Forgery (SSRF)
Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...
CVE-2024-26026
CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...
GHSA-VCVR-R3JV-PC5J Next.js: Remote Code Execution in next/og ImageResponse
Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...
NPM: Next.js: Remote Code Execution in next/og ImageResponse
NPM: Next.js: Remote Code Execution in next/og ImageResponse vulnerability discovered by ? in WordPress Npm next versions = 16.2.0, 16.3.6...
Next.js: Remote Code Execution in next/og ImageResponse
Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...
CVE-2024-46982-NUCLEI
This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun run dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying pages/index.js. The page...
react-cve-2025-55182-lab
Configuración: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab cd react-cve-2025-55182-lab sudo docker build -t react-rsc-lab . sudo docker run -p 3000:3000 react-rsc-lab Explotación: curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H...
EUVD-2026-90415
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...