https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T19:21:26.034400+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-06T19:21:26.105363+00:00 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/euvd-2026-244243 EUVD-2026-244243 2026-10-06T19:21:26.105411+00:00 EUVD-2026-244243 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48068 fkie_cve-2025-48068 2026-10-06T19:21:26.105426+00:00

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

 https://cve.radiocsirt.org/vuln/ghsa-3h52-269p-cp9r GHSA-3h52-269p-cp9r — Information exposure in Next.js dev server due to lack of origin verification 2026-10-06T19:21:26.105458+00:00

Affected: npm: next

## Summary

A low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. [Learn more](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins).

Learn more: https://vercel.com/changelog/cve-2025-48068

## Credit

Thanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1166 WID-SEC-W-2025-1166 — Vercel Next.js: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-06T19:21:26.105489+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Informationen offenzulegen.