CVE-2026-75604 — Path Traversal in Next

Vendor	Product	Version range	Fixed in
next	next	>= 13.4.0 < 15.5.24	15.5.24
next	next	>= 16.0.0 < 16.3.3	16.3.3
vercel	next.js	—	—
vercel	next.js	—	—

Rapid7

Metasploit Wrap Up: This One Goes to Sixteen!

blogs_rapid7·2026-09-11·CVSS 8.4

CVE-2025-66516 [HIGH] Metasploit Wrap Up: This One Goes to Sixteen! ## This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers! ## New module content (16) ## Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon Type: Auxiliary Pull request: #21739 contributed by kmkz Path: scanner/http/elasticsearch_tika_xfa_xxe CVE reference: CVE-2025-66516 Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed thro

Hackernews

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

blogs_hackernews·2026-08-31

CVE-2026-81578 ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More Home Threat Intelligence Vulnerabilities Cyber Attacks Webinars Expert Insights Awards Webinars Awards Free eBooks About THN Jobs Advertise with us ## ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look. Here is the week... ## ⚡ Threat of the

Checkpoint

31th August – Threat Intelligence Report

blogs_checkpoint·2026-08-31

CVE-2026-81578 31th August – Threat Intelligence Report Latest Publications CPR Podcast Channel AI Research Intelligence Reports ThreatCloud AI Threat Intelligence & Research Zero Day Protection Sandblast File Analysis About Us SUBSCRIBE 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 ## 31th August – Threat Intelligence Report For the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, vehicle registration numbers, and information collected through car park, lounge, fast-track, and W

Hackernews

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

blogs_hackernews·2026-08-27

CVE-2026-75604 Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE Home Threat Intelligence Vulnerabilities Cyber Attacks Webinars Expert Insights Awards Webinars Awards Free eBooks About THN Jobs Advertise with us ## Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE Credit: Hacktron Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially crafted AVIF image files and the other through a path traversal flaw affecting servers that use a Windows filesystem. The Windows path traversal, tracked as CVE-2026-75604 (CVSS score: 9.0), affects Next.js applications that use both the Pages Router and App Router without Cache Components when the server uses a Windows filesystem. Linu

Bugzilla

CVE-2026-75604 next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

bugzilla·2026-09-01·CVSS 9.0

CVE-2026-75604 [CRITICAL] CVE-2026-75604 next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-75604 next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execut

CVE-2026-75604: Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App…

Affected

CVSS provenance