GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

CVE-2024-46982-NUCLEI

これは、create-next-app を使用して構築された Next.js プロジェクトです。 はじめに まず、開発サーバーを起動します: npm run dev or yarn dev or pnpm dev or bun run dev http://localhost:3000 をブラウザで開くと、結果が表示されます。 pages/index.js を変更することでページの編集を開始できます。ファイルを編集すると、ページは自動的に更新されます。 API ルート は http://localhost:3000/api/hello でアクセスできます。このエンドポイントは...

cve-2025-55182-lab

CVE-2025-55182 RSC ラボ 意図的に脆弱 認可されたセキュリティ研究用のローカル Docker ラボ: CVE-2025-55182 React2Shell の影響を受けるバージョン範囲の React Server Components / Next.js App Router スタック。 自分のマシンでのみ使用してください。このコンテナをインターネットに公開しないでください。 参考 React Server Components の重大なセキュリティ脆弱性 NVD — CVE-2025-55182 Next.js セキュリティアドバイザリ...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — タイルHTMLフィールドを介したStored XSS（PoC） このリポジトリは、URVE Smart Office のiOSモバイルアプリケーション に影響を与えるStored Cross-Site Scripting（XSS）脆弱性 の概念実証（PoC） を文書化しています。 入力バリデーションの不備により、攻撃者が制御可能なJavaScriptがタイルのHTMLフィールド に注入される可能性があります。ペイロードは保存され、後に影響を受けるコンテンツがモバイルクライアントに配信されiOS端末上でレンダリングされる際に実行されます。 ⚠️...

CVE-2024-47167-Environment-Setup

Components: 1. gradiocontainer: 内部HTTPサーバーをポート5678でホストする 2. targetinternalserver: 脆弱性のあるバージョンのgradio（4.40.0）を使用してPythonアプリを起動する...

PT-2026-107468

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

PT-2026-107689

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A user with the read o11y content capability can inject forged entries into the app log via the REST...

PT-2026-107696

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An issue exists in the Splunk App for Splunk Observability Cloud where the application does not fully...

ASOS Hackers Hijack App Notifications, Claim Snowflake Data Breach

British online fashion retailer ASOS is investigating unauthorised activity after attackers used its official mobile app to send…...

DEBIAN-CVE-2026-106405

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

EUVD-2026-93584

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: Medium...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking これは何ですか？ 攻撃者アプリと被害者アプリは、CVE-2021-33699Task Hijacking 脆弱性を練習するためのものです。 参考 https://naro-security.tistory.com/55...

CVE-2026-106109

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106107

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

CVE-2026-106105

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106109

The Quasar Framework 's @quasar/app-vite component (versions 1.0.0 through 3.3.0) contains a vulnerability where it recursively removes the build.distDir before building. The root cause is a lack of validation to reject sensitive paths such as the project root, user home directory, filesystem roo...