CVE-2026-94545Vulnerability
Reported by 1 independent source · first reported by The Hacker News · last reported
Last reported 19 days ago
higher than 63% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
3 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests“…101906, CVE-2026-101903, CVE-2026-101907, CVE-2026-101905, (Axios), CVE-2026-72018 (Linux kernel), CVE-2026-101169 (Octopus Server), CVE-2026-94545 (Next.js), CVE-2026-73857, CVE-2026-73856 (ModSecurity), CVE-2026-12855 (InsydeH2O IHISI SMM), MTLVULN-1694 (Mitel MiCollab), CVE-20…”
-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“… Orchestrator), CVE-2026-90898 (Bifrost), CVE-2026-86555, CVE-2026-86554, CVE-2026-86553, CVE-2026-86552 (ZTE H188A/H288A firmware), CVE-2026-94545 (Next.js), CVE-2026-94127 (F5 BIG-IP Access Policy Manager), CVE-2026-86296, CVE-2026-86510 (D-Link DIR-822A), CVE-2026-87900, CVE-2…”
-
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input“The flaw, tracked as CVE-2026-94545, affects Next.js 16.2.0 through 16.3.5 when ImageResponse runs on the Node.js runtime, which Next.js uses by default.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-93485, CVE-2026-86555, CVE-2026-86554, CVE-2026-86553, CVE-2026-86552, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-63077, CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248, CVE-2026-86350, CVE-2026-87022, CVE-2026-28324
Thanks — we review every report.