Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
CVE-2026-64649
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 thr
#advisory
共收录 23636 条相关情报。
← 返回所有主题Next.js: Response Body Cache Confusion for Requests Containing Bodies
CVE-2026-64648
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and hei...
CVE-2026-66758
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory alloca
Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
Next.js: Unbounded Server Action payload in Edge runtime
CVE-2026-64646
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call
CVE-2026-17552
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten
Papra: SSRF via HTTP redirect bypass in webhook delivery
CVE-2026-48051
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery sy
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
CVE-2026-55578
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the termin
Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
CVE-2026-64643
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque
Next.js: Denial of Service in App Router using Server Actions
CVE-2026-64641
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
CVE-2026-64645
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
CVE-2023-37465
### Impact It's possible to forge a request to delete a message. ### Patches The problem has been patched in version 2
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
CVE-2026-66731
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
CVE-2026-66729
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows u
unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization
CVE-2026-17531
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality
【TDSQL-C MySQL 版】dbclient 组件升级通知
【TDSQL-C MySQL 版】dbclient 组件升级通知
【TDSQL-C MySQL 版】DBMaster 组件升级通知
【TDSQL-C MySQL 版】DBMaster 组件升级通知
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting...
CVE-2026-15928
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in