Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Group(betwick, vicduong, Hisokaaa) claims Polymarket compromise: 1,609-user PII DB, hardcoded API keys, CVE-2025-62718, CVE-2025-27152, CVE-2024-51479, and alleges $2.5M insider trading on US-Iran markets.
Post summary
The post claims that Polymarket was compromised, leaking a 1,609‑user PII database and hardcoded API keys, and citing multiple CVEs, but it provides no technical or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vercel | next.js | - | node.js | - |