#Vercel
All CosmicBytez Labs articles tagged #Vercel, across news, security advisories, how-to guides, and projects.
- News
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
CVE-2026-99999 (CVSS 9.3) lets a guest VM leak host memory via a kernel checksum bug; found via Vercel's $1M bounty, now patched upstream.
- News
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Vercel shipped an out-of-band fix for two CVSS 9.5 unauthenticated RCE flaws in Next.js caching and SVG processing, plus a high-severity DoS bug.
- News
Vercel Sandbox Flaw Lets Rogue AI Agents Bypass Network Allowlists to Leak Data
AI security firm AIR found a certificate bypass letting agents in Vercel Sandbox exfiltrate data past egress allowlists, unnoticed and unpatched.
- News
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
CVE-2026-94545 (CVSS 9.5) lets attacker-controlled input reach unescaped SVG output in Next.js ImageResponse, enabling RCE. Patched in 16.3.6.
- News
$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
AI-assisted researchers flooded Vercel with reports, forcing the company to automate vulnerability triage.
- News
Next.js Patches Two Critical RCE Flaws — AVIF and Windows Path Traversal
Vercel patched two critical Next.js RCEs: a libheif AVIF heap overflow (CVSS 9.5) and a Windows-only path traversal flaw (CVSS 9.0).
- News
Learning from the Vercel Breach: Shadow AI and OAuth Sprawl
The Vercel breach, traced to a compromised third-party AI tool with OAuth access, illustrates how Shadow AI adoption and unchecked OAuth integrations are...
- News
Vercel Finds More Compromised Accounts in Context.ai-Linked
Vercel has expanded its breach investigation tied to the Context.ai supply chain compromise and identified additional customer accounts with unauthorized...
- News
Cloud Platform Vercel Says Company Breached Through
Vercel has confirmed a security breach in which limited customer credentials were exposed after an employee's workstation was compromised through malware...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- News
Next.js Creator Vercel Hacked
Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million, affecting the company...
- News
Vercel Breach Tied to Context AI Hack Exposes Limited
Vercel's security breach originated from the compromise of Context.ai, a third-party AI tool used by a company employee, allowing attackers to gain...
- News
Vercel Employee's AI Tool Access Led to Data Breach
Stolen OAuth tokens from a compromised employee AI tool enabled attackers to pivot into Vercel's internal systems. Security researchers warn that...
- News
Vercel's Security Breach Started with Malware Disguised as
The Vercel security breach originated at Context.ai after an employee downloaded Lumma Stealer disguised as Roblox cheat software. The incident exposes...
- News
Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New
This week's cybersecurity recap covers the Vercel supply chain breach via a compromised AI tool, push fraud campaigns, attackers abusing QEMU virtual...
- News
Vercel Confirms Breach as Hackers Claim to Be Selling
Cloud development platform Vercel has confirmed a security incident after threat actors claimed to have stolen internal databases, API keys, tokens, and...