Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:55:54 +0000 CVE-2026-94485 — Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass https://vulnerability.circl.lu/vuln/cve-2026-94485 <p><strong>Affected:</strong> vercel next.js</p> <p>Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project&#39;s disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.</p> <p><strong>Affected:</strong> vercel next.js</p> <p>Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project&#39;s disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.</p> https://vulnerability.circl.lu/vuln/cve-2026-94485