62012 matches found
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: OSV:GHSA-2X6F-RP82-PPMJ...
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: GHSA-2X6F-RP82-PPMJ...
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...
CVE-2026-47218
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...
CVE-2026-110601
A flaw was found in libsixel. This vulnerability allows an attacker to cause memory corruption and application crashes, resulting in a Denial of Service DoS, by tricking an application into processing a specially crafted GIF image. The issue occurs because the image parser fails to validate the...
CVE-2026-47218
The runwasi project contains a vulnerability in containerd-shim-wasmtime-v1 prior to version 0.6.1 . The flaw allows an attacker to provide Wasmtime precompiled bytes directly within an OCI image layer, which the shim incorrectly treats as a trusted artifact from the precompile-cache path. By des...
CVE-2026-47218 runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...
EUVD-2026-102247
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...
CVE-2026-62679
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin Modula Image Gallery versions = 3.0.11...
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: MEND:CVE-2026-102527...
CVE-2026-102527
The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...
EUVD-2026-102199
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
Astra Linux – Vulnerability in DjVuLibre
In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error resource exhaustion caused by an infinite loop in GBitmap::readrleraw by creating a corrupted image file, which is related to libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp...