Most recent entries from all

certfr-2026-avi-1256 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-03T01:55:22.777094+00:00

certfr-2026-avi-1256

CLEANSTART-2026-CT47808 — Security fix for CVE-2026-64648 applied in: langfuse 3.208.0-r1, langfuse 3.213.0-r1

2026-10-03T01:55:22.777144+00:00

Affected: CleanStart: langfuse

CVE-2026-64648 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-342019

2026-10-03T01:55:22.777179+00:00

EUVD-2026-342019

fkie_cve-2026-64648

2026-10-03T01:55:22.777193+00:00

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. A safe request would be: fetch(new Request(init), init). An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11.

GHSA-68g3-v927-f742 — Next.js: Cache confusion of response bodies for requests with bodies

2026-10-03T01:55:22.777221+00:00

Affected: npm: next

## Impact

A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.

This only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`. Safe: `fetch(new Request(init), init)` Unsafe: `fetch(new Request(init), aDifferentInit)`

## Workarounds

No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.

RHSA-2026:54435 — Red Hat Security Advisory: Streams for Apache Kafka 3.2.1 release and security update

2026-10-03T01:55:22.777250+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing…

WID-SEC-W-2026-2468 — Vercel Next.js: Mehrere Schwachstellen

2026-10-03T01:55:22.777371+00:00

Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.