{"vulnerability": "cve-2026-9454", "sightings": [{"uuid": "3d55561f-d0cf-4e7d-a548-1db060513e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9454", "type": "seen", "source": "https://bsky.app/profile/cyberowi.pl/post/3mn7kk5sfns2s", "content": "\ud83d\udea8 Krytyczna luka RCE w routerze Totolink A8000RU (CVE-2026-9454)\n\nLuka o krytyczno\u015bci 9.8/10 w routerze Totolink A8000RU pozwala na zdalne wykonanie kodu. Publicznie dost\u0119pny exploit zwi\u0119ksza\n\nhttps://cyberowi.pl/krytyczna-luka-rce-w-routerze-totolink-a8000ru-cve-2026-9454/\n\n#cyberbezpieczenstwo", "creation_timestamp": "2026-06-01T07:27:25.518639Z"}, {"uuid": "e242267d-4336-4a2c-b4ed-c2ad6c20d790", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9454", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motytpbfsq2z", "content": "\ud83d\udea8  ALERT: CVE-2026-9454\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nA flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument ", "creation_timestamp": "2026-06-22T04:01:44.443016Z"}, {"uuid": "42c43de7-5788-4865-9b11-0f5dae39b6ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94540", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2wdagac52e", "content": "\ud83d\udfe0 CVE-2026-94540 - High (7.7)\n\nDesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attac...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-94540/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-22T00:01:44.872885Z"}, {"uuid": "290f075a-080b-4f90-8e73-36557029a416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mw6iine23k2e", "content": "A critical vulnerability (CVE-2026-94545, CVSS 9.5) in Next.js versions 16.2.0 through 16.3.5 allows remote code execution via the ImageResponse feature [\u2026]", "creation_timestamp": "2026-09-23T10:04:52.962608Z"}, {"uuid": "ca5026d0-5647-4019-a0e0-2106980ca08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mw7oos2rfw2s", "content": "\ud83d\udea8 CVE-2026-94545: Critical RCE in Next.js 16.2.0\u201316.3.5 via SVG injection when attacker-controlled input reaches ImageResponse. Next.js 15 and Edge ImageResponse are unaffected.\n\ud83d\udc49 Update to 16.3.6.\nDetails: buff.ly/74eZfz1", "creation_timestamp": "2026-09-23T21:28:21.016035Z"}, {"uuid": "b11145c5-8c19-4213-a972-749b26123583", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwaa7kbv5s2t", "content": "Your link preview just got a day job, Morty. Next.js ImageResponse on Node (CVE-2026-94545, CVSS 9.5) can launder a URL into SVG, then into server shell via Satori. Patch is 16.3.6. Edge version shrugs. Even the thumbnail freelances now. day267.012", "creation_timestamp": "2026-09-24T02:41:58.651078Z"}, {"uuid": "d0361730-a208-49db-b567-93c4a930e1de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwabvl6f5o2n", "content": "Next.js RCE Vulnerability CVE-2026-94545: Critical ImageResponse Flaw Enables Remote Code Execution\uff08Next.js\u306b\u91cd\u5927\u306aRCE\u8106\u5f31\u6027\u3001ImageResponse\u3078\u306e\u7d30\u5de5\u3055\u308c\u305fSVG\u5165\u529b\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\uff09 #SecurityOnline (Sep 23)\n\nsecurityonline.info/nextjs-rce-v...", "creation_timestamp": "2026-09-24T03:12:09.299235Z"}, {"uuid": "a8e9a02e-80b0-4589-875e-675e2740645a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94545", "type": "seen", "source": "https://t.me/thehackernews/10135", "content": "\u203c\ufe0f Next.js patched a critical ImageResponse flaw that can lead to server code execution.\n\n\"CVE-2026-94545\" affects 16.2.0 through 16.3.5 on Node.js when attacker-controlled values reach generated SVG. The fix is 16.3.6.\n\nInside the bug: https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html", "creation_timestamp": "2026-09-23T07:12:34.000000Z"}]}