firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

CVE-2026-19173 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

CVE-2026-71320

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...

Arbitrary Code Injection

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Arbitrary Code Injection via the /nuxtisland/ endpoint when vue.runtimeCompiler is enabled and a server island component forwards attacker-controlled props into Vue's dynamic component resolution. An attacker c...

Arbitrary Code Injection

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Arbitrary Code Injection via the /nuxtisland/ endpoint when vue.runtimeCompiler is enabled and a server island component forwards attacker-controlled props into Vue's dynamic...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the /nuxtisland/ endpoint when vue.runtimeCompiler is enabled and a server island component forwards attacker-controlled props into Vue's dynamic component resolution. An attacker can execute arbitrary code ...

GHSA-9473-5F9J-94WQ Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...

EUVD-2026-53649

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320

Nuxt (Vue.js framework) has a vulnerability affecting versions 3.4.0–3.21.10 and 4.5.1 where an attacker can inject a template key via /__nuxt_island/ props into a dynamic component if vue.runtimeCompiler is enabled, leading to template execution in the Nitro process. This is fixed in 3.21.10 and...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

MAL-2026-11597 Malicious code in @onereach/content-builder-template-compiler (npm)

npm/@onereach/content-builder-template-compiler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +299 more potentially affected by CVE-2026-69151 via @angular/compiler (>=19.0.0, <=19.2.25)

@angular/compiler NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-69151 Source advisory: OSV:GHSA-JJ27-H5HQ-8X99...