vercel
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 113 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 23, 2017 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Next.js: Server-Side Request Forgery in Image Optimization
Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
next.js cache leak on warm `use cache` handlers accessing root param
CVE-2026-94545 (CVSS 9.5) affects Next.js apps using next/og on the Node.js runtime with sharp.
CVE-2026-32740: RCE in a PIE Next.js sharp/libheif Stack
Monitor vercel in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.