Vulnpocalypse: React and Next.js advisorieshttps://vulnpocalypse.dev/feeds/React, React Server Components and Next.js advisories: framework RCEs, middleware bypasses and patched releases.enThu, 12 Nov 2026 16:59:02 +0000Symantec reports AI attack agent built to hijack exposed model endpointshttps://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/Wed, 11 Nov 2026 12:00:00 +0000Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.ai-toolsai-toolswebnextjscloudcryptoNext.js October 2026 security release: two critical RCEs, and check your sharp versionhttps://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/https://vulnpocalypse.dev/advisories/nextjs-october-2026-security-release/Wed, 11 Nov 2026 12:00:00 +0000Next.js 16.4.1 and 15.5.28 fix an unauthenticated RCE via SVG image optimization, a use cache RCE and a Server Actions DoS. Also check sharp is 0.35.5+.exploitednextjsnpmReact2Shell (CVE-2025-55182): the React Server Components RCE, and why the December patch is not enough nowhttps://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/https://vulnpocalypse.dev/advisories/react2shell-cve-2025-55182/Wed, 11 Nov 2026 12:00:00 +0000An unauthenticated RCE in React Server Components hit Next.js App Router apps by default. Exploited within hours. A related RCE was fixed in October 2026.exploitednpmnextjs