Next.js is a popular React-based framework for building server-side rendered and statically generated web applications. It provides a powerful set of features including automatic code splitting, optimized performance, and built-in routing.

Next.js

Rejected reason: This CVE is a duplicate of CVE-2025-55182.

CVE-2025-66478

GitHub Advisory Database

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

React is a JavaScript library for building user interfaces. It is maintained by Facebook and a community of individual developers and companies.

React Server Components

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

CVE-2025-55182

Grafana is an open-source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics and time-series database (TSDB) data.

Grafana

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true

CVE-2025-41115

Chainguard

GoLang

Minimus

Linux

Linux Kernel

Windows

Windows Cumulative Update

VulnCheck NVD++

Wolfi

A web application firewall (WAF) solution that protects web applications and APIs from threats and vulnerabilities through machine learning and AI-powered security. FortiWeb provides protection against OWASP Top 10 threats, zero-day attacks, and bot-based attacks while maintaining high performance and low latency. It offers both cloud-based and on-premises deployment options with features like API protection, automated machine learning, and virtual patching.

Fortinet FortiWeb

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVE-2025-64446

cAdvisor analyzes resource usage and performance characteristics of running containers.

cAdvisor

Docker is a set of platform-as-a-service products that use OS-level virtualization to deliver software in packages called containers.

Docker

Datadog is a monitoring service for cloud-scale applications, providing monitoring of servers, databases, tools, and services through a SaaS-based data analytics platform.

Datadog Agent

NixOS is a Linux distribution built on top of the Nix package manager. It is completely declarative, its system configurations are reproducible, makes configuration changes reliable and atomic, and eliminates configuration drift.

NixOS

Podman is an open-source project that is available on most Linux platforms and resides on GitHub. Podman is a daemonless container engine for developing, managing, and running Open Container Initiative (OCI) containers and container images on your Linux system. Podman provides a Docker-compatible command line front end that can simply alias the Docker CLI, `alias docker=podman`.

Podman

Linux is a family of open-source Unix-like operating systems based on the Linux kernel.

A simple and comprehensive vulnerability scanner for containers, suitable for CI.

Trivy

CRI-O is an implementation of the Kubernetes CRI (Container Runtime Interface) to enable the use of OCI (Open Container Initiative) compatible runtimes. It is a lightweight alternative to using Docker as the runtime for Kubernetes.

CRI-O

Rocky Linux is a Linux distribution intended to be a downstream, complete binary-compatible release using the Red Hat Enterprise Linux operating system source code. The project's aim is to provide a community-supported, production-grade enterprise operating system.

Rocky Linux

The Google OS Config agent runs on your GCP VM and uses the specifications in the guest policy to maintain it in a desired state.

Google OS Config Agent

AlmaLinux OS is an open-source, community-driven Linux operating system that fills the gap left by the discontinuation of the CentOS Linux stable release. AlmaLinux OS is a 1:1 binary compatible fork of RHEL®, guided and built by the community.

Alma Linux

Alibaba Cloud Linux (Aliyun Linux) OS is an open-source Linux distribution originated by the Alibaba Operating System team, aiming to deliver OS services with various functionalities, high performance, and stability to Alibaba Cloud Elastic Compute Service (ECS) customers.

Alibaba Cloud Linux (Aliyun Linux)

Red Hat Enterprise Linux CoreOS (RHCOS) is an operating system based on Red Hat Enterprise Linux (RHEL) that is optimized for running containerized workloads in a clustered environment. It is designed to be used as the foundation for building and managing large-scale, container-based applications and services, such as those used in cloud-native and Kubernetes deployments. RHCOS includes built-in support for automatic updates, self-healing, and other features that are necessary for running distributed systems at scale.

Red Hat Enterprise Linux CoreOS (RHCOS)

CBL Marine is an open source distro, created by Microsoft. Mainly used in Azure cloud and Microsoft Internally.

CBL Mariner

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Kubescape CLI is an open-source Kubernetes security platform that helps identify and fix misconfigurations in Kubernetes clusters. It scans Kubernetes YAML files, Helm charts, and live clusters against various security frameworks and best practices. Kubescape CLI provides detailed risk scoring, compliance reports, and remediation suggestions to improve the security posture of Kubernetes environments.

Kubescape CLI

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Linux openSUSE

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux source code, replacing Red Hat branding with Oracle's.

Linux Oracle

Container-Optimized OS is an operating system image for Compute Engine VMs that is optimized for running Docker containers.

Container-Optimized OS

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

CVE-2025-52881

AlmaLinux

AlmaLinux Security Advisory

Alpine

Alpine Security Tracker

CBL-Mariner

Container-Optimized OS Release Notes

Debian

Debian Security Tracker

Red Hat

Red Hat CoreOS

Red Hat Errata

Rocky

Rocky Linux Product Errata

TuxCare

Ubuntu

Ubuntu Security Tracker

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_pod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation (sh -c) without input validation, allowing shell metacharacters to be interpreted. This vulnerability can be exploited through direct command injection or indirect prompt injection attacks, where AI agents may execute commands without explicit user intent. This vulnerability is fixed in 2.9.8.

CVE-2025-66404

OpenJDK is a free distribution of the JDK, maintained by several vendors and the community. It is a development environment for building applications, applets, and components using the Java programming language.

OpenJDK JDK

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

CVE-2025-66293

Class based , object oriented programming language. Designed to have less dependencies as possible. The syntex of Java is smilier to C and C++. Commonly used for client-server applications. Java files are compiled by JVM (Java Virtual Machine)

Java

Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.

CVE-2025-66453

Maven

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

CVE-2025-66411

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check for SSH certificate revocation. This affects deployments configured with the SSHPOP provisioner. This vulnerability is fixed in 0.29.0.

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2025-66478	CRITICAL	10	Next.js	next	Nein	Ja	Dec 03, 2025
CVE-2025-55182	CRITICAL	10	JavaScript	react-server-dom-webpack	Nein	Ja	Dec 03, 2025
CVE-2025-41115	CRITICAL	10	Grafana	grafana-12.0	Nein	Ja	Nov 21, 2025
CVE-2025-64446	CRITICAL	9.8	Fortinet FortiWeb	cpe:2.3:a:fortinet:fortiweb	Ja	Ja	Nov 14, 2025
CVE-2025-52881	HIGH	7.3	cAdvisor	skopeo	Nein	Ja	Nov 06, 2025

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2025-66404	MEDIUM	6.4	JavaScript	mcp-server-kubernetes	Nein	Ja	Dec 03, 2025
CVE-2025-66293	HIGH	7.1	OpenJDK JDK	java-17-openjdk-headless-slowdebug	Nein	Nein	Dec 03, 2025
CVE-2025-66453	MEDIUM	5.5	Java	org.mozilla:rhino	Nein	Ja	Dec 03, 2025
CVE-2025-66411	HIGH	7.8	N/A	github.com/coder/coder/v2	Nein	Ja	Dec 03, 2025
CVE-2025-66406	MEDIUM	5	N/A	github.com/smallstep/certificates	Nein	Ja	Dec 03, 2025

Datenbank für Wiz-Schwachstellen

Nach Technologie erkunden

Beliebte Filter

Hohes Profil

Neuesten

Schwachstellen in Zahlen

Das Gute, das Böse und das Verletzliche

Zusätzliche Wiz-Ressourcen

Cloud Vulnerability DB

PEACH

Sind Sie bereit, Wiz in Aktion zu sehen?