https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:50:57 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/cleanstart-2026-fv05780 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Package langfuse version 3.213.0-r1 fixes 24 vulnerabilities: CVE-2026-59895, CVE-2026-59896, CVE-2026-59897, CVE-2026-69207, CVE-2026-71848...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Package langfuse version 3.213.0-r1 fixes 24 vulnerabilities: CVE-2026-59895, CVE-2026-59896, CVE-2026-59897, CVE-2026-69207, CVE-2026-71848...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fv05780 https://cve.radiocsirt.org/vuln/euvd-2026-342006 EUVD-2026-342006 https://cve.radiocsirt.org/vuln/euvd-2026-342006 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64645 <p>Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule&#39;s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application&#39;s origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.</p> <p>Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule&#39;s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application&#39;s origin, leading to Server-Side Request forgery. A redirects() rule configured this way is vulnerable to an Open Redirect. This issue has been fixed in versions 15.5.21 and 16.2.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64645 https://cve.radiocsirt.org/vuln/ghsa-p9j2-gv94-2wf4 <p><strong>Affected:</strong> npm: next</p> <p>## Impact</p> <p>A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule&#39;s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application&#39;s origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.</p> <p>This affects any destination that puts a dynamic segment in the hostname, whether from the path:</p> <p>```javascript // next.config.js module.exports = { async rewrites() { return [ { source: &#39;/:tenant&#39;, destination: &#39;https://:tenant.api.example.com&#39;, }, ] }, } ```</p> <p>or from a `has` capture:</p> <p>```javascript // next.config.js module.exports = { async rewrites() { return [ { source: &#39;/&#39;, has: [{ type: &#39;query&#39;, key: &#39;region&#39;, value: &#39;(?&lt;region&gt;.+)&#39; }], destination: &#39;https://:region.api.example.com&#39;, }, ] }, } ```</p> <p>## Workarounds</p> <p>If you cannot upgrade immediately, do not build the hostname of an external `rewrites()` or `redirects()` destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: `value: &#39;(?&lt;region&gt;[a-z0-9-]+)&#39;`.</p> <p><strong>Affected:</strong> npm: next</p> <p>## Impact</p> <p>A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule&#39;s hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application&#39;s origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.</p> <p>This affects any destination that puts a dynamic segment in the hostname, whether from the path:</p> <p>```javascript // next.config.js module.exports = { async rewrites() { return [ { source: &#39;/:tenant&#39;, destination: &#39;https://:tenant.api.example.com&#39;, }, ] }, } ```</p> <p>or from a `has` capture:</p> <p>```javascript // next.config.js module.exports = { async rewrites() { return [ { source: &#39;/&#39;, has: [{ type: &#39;query&#39;, key: &#39;region&#39;, value: &#39;(?&lt;region&gt;.+)&#39; }], destination: &#39;https://:region.api.example.com&#39;, }, ] }, } ```</p> <p>## Workarounds</p> <p>If you cannot upgrade immediately, do not build the hostname of an external `rewrites()` or `redirects()` destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: `value: &#39;(?&lt;region&gt;[a-z0-9-]+)&#39;`.</p> https://cve.radiocsirt.org/vuln/ghsa-p9j2-gv94-2wf4 https://cve.radiocsirt.org/vuln/rhsa-2026:54435 <p>eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing…</p> <p>eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:54435 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2468 <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2468