EUVD-2026-53674

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

EUVD-2026-53697

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-18970

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-67687

The CVE-2026-67687 case concerns ICS-Park Smart Park Management System v2.0 (based on RuoYi). A vertical privilege escalation exists via missing authorization checks in two endpoints: /system/role/save (RoleController.java) and /system/user/update (UserController.java). An authenticated low-privi...

CVE-2026-18970 Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-18970

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-18969 Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

CVE-2026-18969

CVE-2026-18969 – Rongzhitong Visual Integrated Command and Dispatch Platform A vulnerability exists in the file upload path /dm/dispatch/userinfo/upload where argument manipulation of the File parameter enables unrestricted uploads. This could allow remote initiation of an attack with no required...

CVE-2026-71318

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71321

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

NPM: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Impact The internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /nuxtisland/.json with a large JSON body for example 4.6 MB / 150k keys is fully read, destr-parsed, and run through...

CVE-2026-71321 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

CVE-2026-71321 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

CVE-2026-71321

Nuxt.js vulnerability CVE-2026-71321 affects the island rendering endpoint in Nuxt before fixed versions 3.21.10 and 4.5.1. An unauthenticated POST to POST /__nuxt_island/_.json with a large JSON body is fully read, parsed, then hashed using destr and ohash before URL-resident hash validation, ca...

EUVD-2026-53658

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

EUVD-2026-53647

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71318 Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71318

Nuxt (Vue.js framework) is affected in versions 3.1.0 through 3.21.10 and 4.5.1 where a top-level as prop to the /__nuxt_island/ endpoint can drive dynamic component resolution via , resolveDynamicComponent, or h(). This allows potential unauthorized component instantiation as described in the CV...

CVE-2026-70616

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...