Next
Monthly
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prezi Next 1.3.101.11 has a documented purpose of creating HTML5 presentations but has SE_DEBUG_PRIVILEGE on Windows, which might allow attackers to bypass intended access restrictions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.