Vercel has released security patches for two critical-severity vulnerabilities in the Next.js web framework, both of which allow unauthenticated remote code execution, one exploitable via specially ...

Two critical Next.js flaws allow unauthenticated remote code execution on Windows-hosted applications using the Image Optimization API to process AVIF images. The first flaw, tracked as CVE-2026-75604 ...

Cloudflare announced an emergency update to its Cloudflare Managed Ruleset, adding two web application firewall rules for the Brotli vulnerability tracked as CVE-2026-111497.

Next.js patches two critical RCE flaws involving typed arrays and SVG processing, plus a Server Actions DoS affecting App Router apps.

Next.js patched two critical unauthenticated remote code execution flaws and a high-severity flaw that could disrupt application availability.