Known vulnerabilities in Next.js 16.3.7

Vendor: vercel
Software: Next.js
Version: 16.3.7
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 16
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Next.js version 16.3.7 Next.js 16.3.7 is affected by 16 vulnerabilities: 2 high, 8 medium, 6 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU159262 - Insertion of Sensitive Information Into Sent Data
CVE-2026-119346
CWE-201 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159260 - Use of Cache Containing Sensitive Information
CVE-2026-119351
CWE-524 Low
No
No
16.4.2 04.11.2026 SB2026110474
#VU159258 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-119790
CWE-362 Low
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159257 - Improper input validation
CVE-2026-119347
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159254 - Improper input validation
CVE-2026-119350
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159253 - Use of Cache Containing Sensitive Information
CVE-2026-119349
CWE-524 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU155802 - Resource exhaustion
CVE-2026-94482
CWE-400 Medium
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
#VU155801 - Improper input validation
CWE-20 High
No
No
16.4.1 15.10.2026 SB2026101507
#VU155800 - Improper input validation
CVE-2026-96889
CWE-20 High
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
SB2026101539
SB2026102171
and 12 more
#VU153128 - Improper Access Control
CVE-2026-94485
CWE-284 Low
No
No
16.3.8 02.10.2026 SB2026100219
#VU153127 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2026-94484
CWE-349 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219
#VU153126 - Improper input validation
CVE-2026-94543
CWE-20 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219
#VU153125 - Origin Validation Error
CVE-2026-94486
CWE-346 Medium
No
No
16.3.8 02.10.2026 SB2026100219
#VU153124 - Server-Side Request Forgery (SSRF)
CVE-2026-94483
CWE-918 Medium
No
No
16.3.8 02.10.2026 SB2026100219
#VU153123 - Use of Cache Containing Sensitive Information
CVE-2026-94544
CWE-524 Low
No
No
16.3.8 02.10.2026 SB2026100219
#VU153122 - Exposure of sensitive information to an unauthorized actor
CVE-2026-103004
CWE-200 Medium
No
No
16.3.8 02.10.2026 SB2026100219