EUVD-2026-113370

Nuxt dev server exposes private runtime config through the Nitro dev bundle...

CVE-2026-85268 Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...

CVE-2026-85268

A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication for iOS. Affected versions are those prior to 2026-08-14 . An unauthenticated remote attacker can exploit this by using a malicious iOS bundle ID ...

CVE-2026-85268 Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...

CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

CVE-2026-119199

The Nuxt web development framework (versions 3.0.0 through 4.6.3 ) contains a vulnerability where the development server can expose the Nitro 2 development bundle at /dev/index.mjs via Vite file serving when accessible over HTTP. The root cause is that Nitro inlines private runtimeConfig values r...

CVE-2026-119199

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

CVE-2026-33923

A signature verification vulnerability exists in the update installation functionality of Guardian/CMC prior to version 26.4.0 . The root cause is the inconsistent validation of update bundle contents, allowing an attacker with administrative privileges to remotely supply a crafted bundle. While ...

CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

CVE-2026-119199: nuxt: Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

HCL BigFix Server 10.0.x <= 10.0.16 / 11.0.x <= 11.0.7 Certificate Validation (KB0134758)

The version of HCL BigFix Server installed on the remote host is 10.0.x through 10.0.16 or 11.0.x through 11.0.7. It is, therefore, affected by a vulnerability in the bundled CA certificate store: - BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before...

RHEL 8 : libreswan (RHSA-2026:90492)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90492 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

rauc-1.5-integration

Integrating RAUC 1.5 This repository contains examples to simplify integrating the RAUC update into existing projects. You can subscribe to https://github.com/rauc/rauc-1.5-integration/issues/1 to receive notifications of important updates to this repository and of integration into the upstream...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

CVE-2026-116634

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...

EUVD-2026-110063

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...

CVE-2026-116634

OmniRoute versions 3.8.50 before 3.8.52 are vulnerable to a missing authentication flaw (CWE-306). When requireLogin is disabled, unauthenticated attackers can issue sync tokens via POST /api/sync/tokens. These tokens can be used against GET /api/sync/bundle to retrieve decrypted provider credent...

CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...