EUVD-2026-107413

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130

The Nuxt web development framework for Vue.js is vulnerable to a cross-site scripting (XSS) issue prior to version 4.6.0 . When the pages feature is disabled, the no-pages router incorrectly classifies an attacker-controlled input as an internal route if it is prefixed with an ASCII C0 control ch...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

PT-2026-120733

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.0 Description An incomplete fix allows applications with pages disabled to render a script-capable URL through NuxtLink. This occurs when attacker-controlled input bound to the to variable is prefixed with an ASCII C...

Automne.ws CMS 4.0.0rc2 Multiple RFI Vulnerability

No description provided by source. Automne.ws CMS 4.0.0rc2 Multiple RFI Vulnerability Created By 1nd0n3s14n l4m3r c -- 14/12/2oo9 No Sanitize Variable $SERVER"DOCUMENTROOT" automne/imagezoom.php?DOCUMENTROOT=Shell automne/isalive.php?DOCUMENTROOT=Shell automne/admin/backtrace.php?DOCUMENTROOT=She...