GHSA-VHHQ-M2GM-RWC9 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

EUVD-2026-93573

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories...

GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

CVE-2024-46982-NUCLEI

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun run dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying pages/index.js. The page...

cve-2025-55182-lab

CVE-2025-55182 RSC lab intentionally vulnerable Local Docker lab for authorized security research: React Server Components / Next.js App Router with a stack in the CVE-2025-55182 React2Shell affected range. Use only on your own machine. Do not expose this container to the internet. References Rea...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

CVE-2024-47167-Environment-Setup

Components: 1. gradiocontainer: hosts internal HTTP server on port 5678 2. targetinternalserver: launches a python app using vulnerable version of gradio 4.40.0...

CVE-2026-76274: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76280: Incorrect Permission Assignment for Critical Resource

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

PT-2026-107689

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A user with the read o11y content capability can inject forged entries into the app log via the REST...

PT-2026-107696

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An issue exists in the Splunk App for Splunk Observability Cloud where the application does not fully...

PT-2026-107468

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

ASOS Hackers Hijack App Notifications, Claim Snowflake Data Breach

British online fashion retailer ASOS is investigating unauthorised activity after attackers used its official mobile app to send…...

DEBIAN-CVE-2026-106405

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

EUVD-2026-93584

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking What is it? An attacker app and a victim app to practice the CVE-2021-33699Task Hijacking vulnerability. Reference https://naro-security.tistory.com/55...

CVE-2026-106107

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...