Tag archive

Cve 2026 94486

Coverage tagged cve 2026 94486.

Cve 2026 94486 Exploits

Next.js Dev Server MCP Flaw CVE-2026-94486 Lets Malicious Sites Read Source Snippets and Logs

Next.js 16's next dev MCP endpoint skipped origin checks, letting a visited site read disk paths, source snippets, routes and logs. Low severity; fixed in 16.3.8.

Related desks

Exploits

Latest

Oct 2, 2026, 5:20 PM EDT · AI Security · Cve 2026 909707 minGitLab AI Gateway Flaw CVE-2026-90970 Lets Duo Agent Users Run Commands on Self-Hosted Gateways

GitLab fixed a CVSS 9.9 prompt-template sandbox escape in its AI Gateway. Self-hosted gateways must move to 19.2.4, 19.3.2 or 19.4.1.

Oct 2, 2026, 5:02 PM EDT · AI Security · Cve 2026 1037585 minObot MCP Gateway Flaw CVE-2026-103758 Lets Basic Users Reach Restricted MCP Servers

Obot 0.21.1–0.24.1 skips its ACR check on the composite MCP route, so any signed-in user can reach restricted servers. Obot says v0.25.0 fixes it.

Oct 2, 2026, 4:54 PM EDT · Exploits · Cve 2026 944865 minNext.js Dev Server MCP Flaw CVE-2026-94486 Lets Malicious Sites Read Source Snippets and Logs

Next.js 16's next dev MCP endpoint skipped origin checks, letting a visited site read disk paths, source snippets, routes and logs. Low severity; fixed in 16.3.8.

Oct 2, 2026, 3:31 PM EDT · Exploits · Local Privilege Escalation5 minWindows Cross Device flaw gives local users SYSTEM, with a public PoC

Project Zero's Forshaw details CVE-2026-66804, an incomplete fix for the Dark Elevator bug. A working exploit is public; August 2026 updates fix it.