CVE-2026-102650

Nuxt Content, a file-based CMS for Nuxt applications, is vulnerable to an unauthenticated Denial of Service (DoS) via the POST /__nuxt_content/:collection/query endpoint in versions 3.0.0 through 3.15.2 . The issue stems from a validation gap in src/runtime/internal/security.ts (specifically the ...

EUVD-2026-118389

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /nuxtcontent/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite...