// day
May 6, 2026
2 new incidents, 0 with updates.
## started
- highclosedpatchedclosed May 7, 2026
Next.js / React Server Components May 2026 security release
› Next.js; react-server-dom-webpack/parcel/turbopack
Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.
CVE-2026-23870 - highclosedpatchedclosed May 6, 2026
Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
› Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. Added to CISA KEV on 2026-05-06.
CVE-2026-0300
