https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:57:52.946841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-1137 certfr-2025-avi-1137 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-08T06:57:52.993734+00:00 certfr-2025-avi-1137 https://cve.radiocsirt.org/vuln/euvd-2026-251713 EUVD-2026-251713 2026-10-08T06:57:52.993773+00:00 EUVD-2026-251713 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57822 fkie_cve-2025-57822 2026-10-08T06:57:52.993787+00:00

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

 https://cve.radiocsirt.org/vuln/ghsa-4342-x723-ch2f GHSA-4342-x723-ch2f — Next.js Improper Middleware Redirect Handling Leads to SSRF 2026-10-08T06:57:52.993818+00:00

Affected: npm: next

A vulnerability in **Next.js Middleware** has been fixed in **v14.2.32** and **v15.4.7**. The issue occurred when request headers were directly passed into `NextResponse.next()`. In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the `next()` function.

More details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57822)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1934 WID-SEC-W-2025-1934 — Vercel Next.js: Mehrere Schwachstellen 2026-10-08T06:57:52.993844+00:00

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um vertrauliche Informationen offenzulegen, Daten zu manipulieren und so Server-Side Request Forgery- oder Phishing-Angriffe durchzuführen.