Known vulnerabilities in Next.js - page 4

Vendor: vercel
Software: Next.js
Software CPE: cpe:2.3:a:vercel:nextjs:*:*:*:*:*:*:*:*
Total vulnerabilities: 84
Public exploits: 9
Known exploited (KEV): 3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Next.js Next.js is affected by 84 known vulnerabilities: 1 critical, 11 high, 53 medium, 19 low Critical High Medium Low

Vulnerabilities (84)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU159254 - Improper input validation
CVE-2026-119350
CWE-20 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159253 - Use of Cache Containing Sensitive Information
CVE-2026-119349
CWE-524 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU159251 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-119348
CWE-444 Medium
No
No
1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 7.0.0.0, 7.0.1.0, 15.5.29, 16.4.5 04.11.2026 SB2026110471
#VU155802 - Resource exhaustion
CVE-2026-94482
CWE-400 Medium
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
#VU155801 - Improper input validation
CWE-20 High
No
No
16.4.1 15.10.2026 SB2026101507
#VU155800 - Improper input validation
CVE-2026-96889
CWE-20 High
No
No
15.5.28, 16.4.1 15.10.2026 SB2026101507
SB2026101539
SB2026102171
and 12 more
#VU153128 - Improper Access Control
CVE-2026-94485
CWE-284 Low
No
No
16.3.8 02.10.2026 SB2026100219
#VU153127 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2026-94484
CWE-349 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219
#VU153126 - Improper input validation
CVE-2026-94543
CWE-20 Low
No
No
15.5.27, 16.3.8 02.10.2026 SB2026100219
#VU153125 - Origin Validation Error
CVE-2026-94486
CWE-346 Medium
No
No
16.3.8 02.10.2026 SB2026100219
#VU153124 - Server-Side Request Forgery (SSRF)
CVE-2026-94483
CWE-918 Medium
No
No
16.3.8 02.10.2026 SB2026100219
#VU153123 - Use of Cache Containing Sensitive Information
CVE-2026-94544
CWE-524 Low
No
No
16.3.8 02.10.2026 SB2026100219
#VU153122 - Exposure of sensitive information to an unauthorized actor
CVE-2026-103004
CWE-200 Medium
No
No
16.3.8 02.10.2026 SB2026100219
#VU145734 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-75604
CWE-22 High
Available
Exploited
15.5.24, 16.3.3 26.08.2026 SB2026082633
SB2026110605
#VU145733 - Memory corruption
CWE-119 High
No
No
15.5.24, 16.3.3 26.08.2026 SB2026082633
#VU26476 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-5284
CWE-22 Medium
No
No
9.3.2 31.03.2020 SB2020033113
#VU15347 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-18282
CWE-79 Low
No
No
7.0.2 14.10.2018 SB2018101403
#VU37594 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-6184
CWE-22 Medium
No
No
- 24.01.2018 SB2018012426
#VU31397 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2017-16877
CWE-22 Medium
No
No
2.4.1 17.11.2017 SB2017111707
#VU6872 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
- 02.06.2017 SB2017060209


Showing elements 61 - 80 out of 84