github.com/dair-ai/Prompt-Engineering-Guide
Submitted 8/4/2026, 10:25:56 AM · Status: ok
Risk grade
F
100 / 100
Findings
555
2 critical87 high424 medium40 low2 info0 on CISA KEV0ATT&CK
Showing 555 of 555 findings
Findings
- Authorization Bypass in Next.js MiddlewaregrypeCVE-2025-29927EPSS 99.3%
- nextjs: Authorization Bypass in Next.js MiddlewareNext.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware…trivyCVE-2025-29927
- @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputgrypeCVE-2026-44728EPSS 0.1%
- @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputgrypeCVE-2026-44728EPSS 0.1%
- DOMPurify allows tampering by prototype pollutiongrypeCVE-2024-45801EPSS 0.8%
- DOMpurify has a nesting-based mXSSgrypeCVE-2024-47875EPSS 1.1%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- Next has a Denial of Service with Server Components - Incomplete Fix Follow-Upgrype
- Next has a Denial of Service with Server Components - Incomplete Fix Follow-Upgrype
- Next Vulnerable to Denial of Service with Server Componentsgrype
- Next Vulnerable to Denial of Service with Server Componentsgrype
- next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX contentgrypeCVE-2026-0969EPSS 0.6%
- Next.js authorization bypass vulnerabilitygrypeCVE-2024-51479EPSS 4.0%
- Next.js authorization bypass vulnerabilitygrypeCVE-2024-51479EPSS 4.0%
- Next.js Cache PoisoninggrypeCVE-2024-46982EPSS 58.8%
- Next.js has a Denial of Service with Server Componentsgrype
- Next.js has a Denial of Service with Server Componentsgrype
- Next.js has a Middleware / Proxy bypass in Pages Router applications using i18ngrypeCVE-2026-44573EPSS 0.6%
- Next.js has a Middleware / Proxy bypass in Pages Router applications using i18ngrypeCVE-2026-44573EPSS 0.6%
- Next.js HTTP request deserialization can lead to DoS when using insecure React Server Componentsgrype
- Next.js HTTP request deserialization can lead to DoS when using insecure React Server Componentsgrype
- Next.js Server-Side Request Forgery in Server ActionsgrypeCVE-2024-34351EPSS 5.5%
- Next.js Server-Side Request Forgery in Server ActionsgrypeCVE-2024-34351EPSS 5.5%
- Next.js Vulnerable to Denial of Service with Server Componentsgrype
- Next.js Vulnerable to Denial of Service with Server Componentsgrype
- Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesgrypeCVE-2026-44578EPSS 38.9%
- Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesgrypeCVE-2026-44578EPSS 38.9%
- Next.js: Denial of Service in App Router using Server ActionsgrypeCVE-2026-64641EPSS 0.5%
- Next.js: Denial of Service in App Router using Server ActionsgrypeCVE-2026-64641EPSS 0.5%
- Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamegrypeCVE-2026-64645EPSS 1.0%
- Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamegrypeCVE-2026-64645EPSS 1.0%
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsgrypeCVE-2026-45623EPSS 0.5%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurifygrype
- Regular Expression Denial of Service (ReDoS) in cross-spawngrypeCVE-2024-21538EPSS 0.9%
- SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)grypeCVE-2026-29074EPSS 0.6%
- SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)grypeCVE-2026-29074EPSS 0.6%
- SVGO removeScripts plugin leaves some executable scripts intactgrype
- SVGO removeScripts plugin leaves some executable scripts intactgrype
- Babel is a compiler for writing next generation JavaScript. From 7.12. ...Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed …trivyCVE-2026-44728
- Babel is a compiler for writing next generation JavaScript. From 7.12. ...Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed …trivyCVE-2026-44728
- cross-spawn: regular expression denial of serviceVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted …trivyCVE-2024-21538
- cross-spawn: regular expression denial of serviceVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted …trivyCVE-2024-21538
- dompurify: nesting-based mutation XSS vulnerabilityDOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.trivyCVE-2024-47875
- dompurify: XSS vulnerability via prototype pollutionDOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollut…trivyCVE-2024-45801
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- lodash: lodash: Arbitrary code execution via untrusted input in template importsImpact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an a…trivyCVE-2026-4800
- lodash: lodash: Arbitrary code execution via untrusted input in template importsImpact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an a…trivyCVE-2026-4800
- lodash: lodash: Arbitrary code execution via untrusted input in template importsImpact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an a…trivyCVE-2026-4800
- Next has a Denial of Service with Server Components - Incomplete Fix Follow-UpIt was discovered that the fix for [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trig…trivy
- Next has a Denial of Service with Server Components - Incomplete Fix Follow-UpIt was discovered that the fix for [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types. As a result, certain crafted inputs could still trig…trivy
- Next Vulnerable to Denial of Service with Server ComponentsA vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://ww…trivy
- Next Vulnerable to Denial of Service with Server ComponentsA vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://ww…trivy
- next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX contentThe serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.trivyCVE-2026-0969
- next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX contentThe serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.trivyCVE-2026-0969
- next: Next.js Server-Side Request Forgery in Server ActionsNext.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able …trivyCVE-2024-34351
- next: Next.js Server-Side Request Forgery in Server ActionsNext.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able …trivyCVE-2024-34351
- next: Next.js: Denial of Service via crafted requests to App Router with Server ActionsNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processi…trivyCVE-2026-64641
- next: Next.js: Denial of Service via crafted requests to App Router with Server ActionsNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processi…trivyCVE-2026-64641
- next: Next.js: Server-Side Request Forgery vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostn…trivyCVE-2026-64645
- next: Next.js: Server-Side Request Forgery vulnerabilityNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostn…trivyCVE-2026-64645
- Next.js Cache PoisoningNext.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it…trivyCVE-2024-46982
- Next.js has a Denial of Service with Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react…trivy
- Next.js has a Denial of Service with Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react…trivy
- Next.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://git…trivy
- Next.js HTTP request deserialization can lead to DoS when using insecure React Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://git…trivy
- Next.js Vulnerable to Denial of Service with Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react…trivy
- Next.js Vulnerable to Denial of Service with Server ComponentsA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react…trivy
- next.js: next: authorization bypass in Next.jsNext.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root …trivyCVE-2024-51479
- next.js: next: authorization bypass in Next.jsNext.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root …trivyCVE-2024-51479
- next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-l…trivyCVE-2026-44573
- next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-l…trivyCVE-2026-44573
- Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requestsNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker ca…trivyCVE-2026-44578
- Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requestsNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker ca…trivyCVE-2026-44578
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…trivy
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…trivy
- postcss: PostCSS: Information disclosure and denial of service via crafted CSS inputPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…trivyCVE-2026-45623
- postcss: PostCSS: Information disclosure and denial of service via crafted CSS inputPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…trivyCVE-2026-45623
- Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurifyThe following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack. This affects the built: - `dist/mermaid.m…trivy
- SVGO removeScripts plugin leaves some executable scripts intact### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. ### Detai…trivy
- SVGO removeScripts plugin leaves some executable scripts intact### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. ### Detai…trivy
- svgo: SVGO: Denial of Service via XML entity expansionSVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards again…trivyCVE-2026-29074
- svgo: SVGO: Denial of Service via XML entity expansionSVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards again…trivyCVE-2026-29074
This report is public.