Next.js: Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64649
## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound
#advisory
共收录 23779 条相关情报。
← 返回所有主题Next.js: Cache confusion of response bodies for requests with bodies
CVE-2026-64648
## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
CVE-2026-64647
## Impact A server-side `fetch` with a request body may return a cached **response** body from a different request to t
Next.js: Unbounded Server Action payload in Edge runtime
CVE-2026-64646
## Impact Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessiv
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
CVE-2026-64645
## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled in
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely ho
Next.js: Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64643
## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be discl
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642
## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry
Next.js: Denial of Service in App Router using Server Actions
CVE-2026-64641
## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
CVE-2024-7708
### Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused t
Eclipse Jetty: Path parameter traversal
CVE-2026-8384
### Description (as reported) #### Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave d
Eclipse Jetty: HTTP Authority/Host mismatch
CVE-2026-6790
#### Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :au
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
CVE-2026-10051
### Description > FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) > HttpConnection._trailers Cross-Req
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
CVE-2026-10050
### Summary The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
CVE-2026-65589
## Impact Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemo
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
CVE-2026-59943
### Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG render
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
CVE-2026-59942
### Summary Dompdf v3.1.5 is vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can cra
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
CVE-2026-59941
### Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its *declared* header dimension
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
CVE-2026-59821
### Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and valida
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVE-2026-59822
### Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated