Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

The feed highlights multiple high-impact cybersecurity developments, led by critical unauthenticated remote-code-execution vulnerabilities in Next.js, including AVIF processing and Windows path traversal flaws. It also covers actively exploited vulnerabilities in Gitea and other products, unpatched Kaltura mwEmbed flaws enabling arbitrary file reads and code execution, GPU Rowhammer privilege escalation, AI-agent prompt injection and model-poisoning risks, phishing and session theft campaigns, malware, state-sponsored activity, and major law-enforcement disruptions.