sharp

Search everything

Mentions · 7d0
Mentions · 30d3
All mentions4
First seenAug 27, 2026
Last mentioned15d ago

Timeline

4 articles · newest first

Critical Next.js Vulnerabilities Allow Hackers to Execute Malicious Code Remotely

Next.js patches two unauthenticated remote-code-execution flaws and a denial-of-service bug in 15.5.28 and 16.4.1.

Cyber Security NewsOct 15, 12:39 UTC · 15d agoVulnerabilityCVE-2026-968898 · 7 reads

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.

The Hacker NewsOct 15, 12:28 UTC · 15d agoVulnerabilityCVE-2026-968898 · 3 reads

Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution

Vercel patched unauthenticated Next.js remote code execution in SVG image optimization, with no active exploitation reported.

GBHackersOct 15, 10:36 UTC · 15d agoVulnerabilityCVE-2026-968897 · 2 reads

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

The Hacker NewsAug 27, 15:16 UTC · Aug 27, 2026VulnerabilityCVE-2026-756042 · 1 read

Related CVEs

by mentions

CVE-2026-96889<1%7.8
Use-After-Free in librsvg SVG Parsing via Nested XIncludes and Duplicate Entities
published Sep 23, 2026GNOME Project librsvgPoC
CVE-2026-756042%9.0
Unauthenticated RCE in Next.js on Windows-hosted servers
published Sep 1, 2026Vercel Next.js — applications using the Pages Router (without Cache Components) on Windows-hosted serversPoC

Appears with

Next.jsproduct · 4
Vercelvendor · 4
Vercelorganization · 3
Red Hatorganization · 1
React Server Componentsproduct · 1
Netlifyorganization · 1
Hacktronorganization · 1
librsvgproduct · 1
libheifproduct · 1
Reactproduct · 1
libheifvendor · 1

Entities are extracted by the model from each article. First seen Aug 27, 2026, last mentioned 15d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.