Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Linked advisories
Affected vendors and products
More on Unauthenticated
Other advisories
- CriticalCVE-2026-123490Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491)
- CriticalCVE-2026-121640WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640)
- CriticalCVE-2026-73578Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass
- Not ratedosv:CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- Not ratedosv:CVE-2026-63482Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
- Lowghsa:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
Other news entries
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityNewsCisco PSIRT
- Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick UploadsNewsThe Hacker News
- Cisco Secure Email Gateway SQL Injection VulnerabilityNewsCisco PSIRT
- Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersNewsThe Hacker News
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessNewsThe Hacker News
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
Source: https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html
ID