EUVD-2026-53695

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

Linux Distros Unpatched Vulnerability : CVE-2026-71311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filena...

EulerOS 2.0 SP13 : sed (EulerOS-SA-2026-3049)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

PT-2026-68948

Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a...

EulerOS 2.0 SP13 : sed (EulerOS-SA-2026-2999)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

EulerOS 2.0 SP15 : python-urllib3 (EulerOS-SA-2026-2946)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EulerOS 2.0 SP13 : cups (EulerOS-SA-2026-3011)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

CVE-2026-71321 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

DEBIAN-CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

CVE-2026-15996

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...

CVE-2026-71316

CVE-2026-71316 affects Nuxt (Vue.js framework). From 4.4.0 through 4.5.1, runtime cache:nuxt:payload entries for //_payload.json could be returned before route middleware and page guards because import.meta.prerender was not enforced, potentially disclosing another user’s SSR data. The issue is f...

CVE-2026-71315

Nuxt.js vulnerability CVE-2026-71315 affects Nuxt framework versions 3.21.7–3.21.10 and 4.5.1. Affected component is the router routeRules logic: mixed-case keys can fail to match case-folded lookups when router.options.sensitive is false, causing appMiddleware authorization gates to be silently ...

CVE-2026-71313

The CVE affects the rclone local backend (local.go) from v1.51.0 through v1.75.0. A faulty filename encoder allows certain encodings (Slash, None, Raw, or Windows-preserving backslash variants) to be decoded into an actual parent-directory component by filepath.Join, enabling an attacker-controll...

GHSA-5H86-PH4P-6P7W vulnerabilities

Vulnerabilities for packages: ruby4.0-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch...

GHSA-557M-FHM3-G2JC vulnerabilities

Vulnerabilities for packages: chromium...

EUVD-2026-53602

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...