Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (12.2.1.4.0 / 14.1.2.0.0)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that a...

Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)

The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...

KLA91178 SUI vulnerability in Microsoft Server Software

User interface spoofing vulnerability was found in Microsoft Server Software. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2026-56191 Exploitation CVE list CVE-2026-56191 critical KB list Solution Install necessary updates from the KB section, th...

ALSA-2026:44308 Important: libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6477 For more details about the security issues,...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded...

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers

NPM: Next.js: Server-Side Request Forgery in Server Actions on custom servers vulnerability discovered by ? in WordPress Npm next versions = 14.1.1, 15.5.21...

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

GHSA-89XV-2M56-2M9X Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

Next.js: Cache confusion of response bodies for requests with bodies

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending...

GHSA-4633-3J49-MH5Q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issu...

Improper Encoding or Escaping of Output

Overview next is a react framework. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request...

Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

GHSA-4C39-4CCG-62R3 Next.js: Unbounded Server Action payload in Edge runtime

Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime Workarounds If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be...

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname vulnerability discovered by ? in WordPress Npm next versions = 12.0.0, 15.5.21...

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the prepareDestination rewrite/redirect handling in packages/next/src/shared/lib/router/utils/prepare-destination.ts. An attacker can make the application proxy a request t...

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...