https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T15:31:44.130754+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-1137 certfr-2025-avi-1137 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-08T15:31:44.180024+00:00 certfr-2025-avi-1137 https://cve.radiocsirt.org/vuln/euvd-2026-251727 EUVD-2026-251727 2026-10-08T15:31:44.180067+00:00 EUVD-2026-251727 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55173 fkie_cve-2025-55173 2026-10-08T15:31:44.180083+00:00

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.

 https://cve.radiocsirt.org/vuln/ghsa-xv57-4mr9-wg8v GHSA-xv57-4mr9-wg8v — Next.js Content Injection Vulnerability for Image Optimization 2026-10-08T15:31:44.180114+00:00

Affected: npm: next

A vulnerability in **Next.js Image Optimization** has been fixed in **v15.4.5** and **v14.2.31**. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on `images.domains` or `images.remotePatterns` are encouraged to upgrade and verify that external image sources are strictly validated.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-55173)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1934 WID-SEC-W-2025-1934 — Vercel Next.js: Mehrere Schwachstellen 2026-10-08T15:31:44.180150+00:00

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren und so Server-Side Request Forgery- oder Phishing-Angriffe durchzuführen.