Vulnerabilities in vercel
76 resultsCVE-2026-94484MEDIUMNext.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of serviceEPSS 0.2%CVE-2024-24828MEDIUMLocal Privilege Escalation in execuatables bundled by pkgEPSS 0.2%CVE-2026-44581MEDIUMNext.js: Cross-site scripting in App Router applications using CSP noncesEPSS 0.2%CVE-2026-44582LOWNext.js: Cache poisoning via collisions in React Server Component cache-bustingEPSS 0.2%CVE-2026-27978MEDIUMNext.js: null origin can bypass Server Actions CSRF checksEPSS 0.2%CVE-2026-44580MEDIUMNext.js: Cross-site scripting in beforeInteractive scripts with untrusted inputEPSS 0.2%CVE-2025-48068LOWInformation exposure in Next.js dev server due to lack of origin verificationEPSS 0.2%CVE-2026-27977LOWNext.js: null origin can bypass dev HMR websocket CSRF checksEPSS 0.2%CVE-2026-94544MEDIUMNext.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesEPSS 0.2%CVE-2026-64651MEDIUMAI SDK OpenCode Harness Tool Relay Authorization BypassEPSS 0.2%CVE-2026-64650MEDIUMAI SDK Codex Harness Tool Relay Authorization BypassEPSS 0.2%CVE-2026-94485MEDIUMNext.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypassEPSS 0.2%CVE-2026-44479MEDIUMVercel: Non-interactive mode includes CLI arguments in suggested command outputEPSS 0.2%CVE-2026-46508HIGHTurborepo: VSCode Extension command injectionEPSS 0.2%CVE-2026-45773MEDIUMTurborepo: Login callback CSRF/session fixationEPSS 0.1%CVE-2026-94486LOWNext.js: Information disclosure in the Next.js development server's Model Context Protocol endpointEPSS 0.1%