CVE-2026-94545 2

Vulnerability (CVE)

Critical Next.js Image Response Flaw Can Lead to Server Code Execution via Crafted SVG Input

Vercel fixed a critical Next.js flaw, CVE-2026-94545, on September 22 in version 16.3.6; it affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the default Node.js runtime and carries a CVSS score of 9.5. The bug is in Satori, the Vercel...

Vulnerabilities & Patching

⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

Cyber Risks The Hacker News

A placeholder domain that appeared in roughly 1,700 repositories was registered by someone and used to serve malicious lures. Citrix released patches for CVE-2026-88771, an improper input validation flaw allowing unauthenticated arbitrary command...

Vulnerabilities & Patching