https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:38:30 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0760 https://cve.radiocsirt.org/vuln/euvd-2026-244243 EUVD-2026-244243 https://cve.radiocsirt.org/vuln/euvd-2026-244243 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48068 <p>Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.</p> <p>Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48068 https://cve.radiocsirt.org/vuln/ghsa-3h52-269p-cp9r <p><strong>Affected:</strong> npm: next</p> <p>## Summary</p> <p>A low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.</p> <p>Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. [Learn more](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins).</p> <p>Learn more: https://vercel.com/changelog/cve-2025-48068</p> <p>## Credit</p> <p>Thanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.</p> <p><strong>Affected:</strong> npm: next</p> <p>## Summary</p> <p>A low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.</p> <p>Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure `allowedDevOrigins` in your next config after upgrading to a patched version. [Learn more](https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins).</p> <p>Learn more: https://vercel.com/changelog/cve-2025-48068</p> <p>## Credit</p> <p>Thanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-3h52-269p-cp9r https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1166 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Vercel Next.js ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1166