https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:02:34 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/cleanstart-2026-fv05780 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Package langfuse version 3.213.0-r1 fixes 24 vulnerabilities: CVE-2026-59895, CVE-2026-59896, CVE-2026-59897, CVE-2026-69207, CVE-2026-71848...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Package langfuse version 3.213.0-r1 fixes 24 vulnerabilities: CVE-2026-59895, CVE-2026-59896, CVE-2026-59897, CVE-2026-69207, CVE-2026-71848...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fv05780 https://cve.radiocsirt.org/vuln/euvd-2026-341426 EUVD-2026-341426 https://cve.radiocsirt.org/vuln/euvd-2026-341426 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64647 <p>Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST&#39;s response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.</p> <p>Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST&#39;s response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64647 https://cve.radiocsirt.org/vuln/ghsa-4633-3j49-mh5q <p><strong>Affected:</strong> npm: next</p> <p>## Impact</p> <p>A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`&#39;s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.</p> <p>This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `삃삃` and `섄섄` in the request body would share the same cache.</p> <p>## Workarounds</p> <p>If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.</p> <p><strong>Affected:</strong> npm: next</p> <p>## Impact</p> <p>A server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`&#39;s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.</p> <p>This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `삃삃` and `섄섄` in the request body would share the same cache.</p> <p>## Workarounds</p> <p>If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.</p> https://cve.radiocsirt.org/vuln/ghsa-4633-3j49-mh5q https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2468 <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Daten zu manipulieren, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2468