CVE-2026-92931
Last modified
CVE-2026-92931 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | @progress/sitefinity-nextjs-sdk | >= 15.1.8326, < 15.4.8638 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92931?
How severe is CVE-2026-92931?
How do I fix CVE-2026-92931?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92925A flaw was found in Redis community. The cluster bus packet …7.1
- CVE-2026-92926A vulnerability has been found in code-projects Matrimonial …7.3
- CVE-2026-92927A vulnerability was found in SourceCodester Drug Recommendat…5.3
- CVE-2026-92928OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376…6.5
- CVE-2026-92929OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376…5.3
- CVE-2026-92930OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376…6.2
- CVE-2026-92932In the MISP sachertortephp library, the Xml::build() static …5.1
- CVE-2026-92933vm2 is a sandbox for running untrusted Node.js code. In vers…5.8
- CVE-2026-92934vm2 before 3.11.8 contains an incomplete fix for Error.cause…9
- CVE-2026-92935vm2 is a sandbox for running untrusted Node.js code. In vers…9
- CVE-2026-92936vm2 versions 3.11.0 through 3.11.6 leak absolute host filesy…5.8
- CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remo…10
Are you affected by CVE-2026-92931?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST