{"id":"CVE-2026-92931","revision":"fe836d84242f413ba48567b46f5f6e96","records":[{"revision":"fe836d84242f413ba48567b46f5f6e96","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92931","aliases":[],"title":"CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK","description":"CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.","state":0,"publishedAt":"2026-10-05T13:06:02.081+00:00","modifiedAt":"2026-10-06T17:48:45.628+00:00","affected":[{"ecosystem":"Vendor product","name":"@progress/sitefinity-nextjs-sdk","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progress Software\",\n                    \"product\": \"@progress/sitefinity-nextjs-sdk\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"15.1.8326\",\n                            \"lessThan\": \"15.4.8638\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92931","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92931","identifiers":["CVE-2026-92931"]},"retained":false,"historicalAffected":[]}],"coverage":[]}