166175 matches found
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
Impact The internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /nuxtisland/.json with a large JSON body for example 4.6 MB / 150k keys is fully read, destr-parsed, and run through...
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Impact Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint ws://:/, subprotocol vite-hmr can call RPC methods,...
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves //payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...
CVE-2026-8709
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
ROOT-APP-PYPI-CVE-2024-3772 CVE-2024-3772 in pydantic - Patched by Root
Root has patched CVE-2024-3772 in the pydantic package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-25577 CVE-2023-25577 in Werkzeug - Patched by Root
Root has patched CVE-2023-25577 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in Jinja2 - Patched by Root
Root has patched CVE-2024-56201 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-22195 CVE-2024-22195 in Jinja2 - Patched by Root
Root has patched CVE-2024-22195 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in Jinja2 - Patched by Root
Root has patched CVE-2025-27516 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
CVE-2026-8709
Progress MarkLogic Server contains an improper privilege management vulnerability in the REST API document patch operation. An authenticated user with a low-privileged REST role can escalate privileges and perform privileged operations against the Security database. Affected versions are before 1...
CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
EUVD-2026-53425
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
Ghost: Cross-Site Scripting in Feature Image Captions
Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...
ROOT-OS-DEBIAN-12-CVE-2026-11972 CVE-2026-11972 in python3.11 - Patched by Root
Root has patched CVE-2026-11972 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-15308 CVE-2026-15308 in python3.11 - Patched by Root
Root has patched CVE-2026-15308 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-9669 CVE-2026-9669 in python3.11 - Patched by Root
Root has patched CVE-2026-9669 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-1502 CVE-2026-1502 in python3.11 - Patched by Root
Root has patched CVE-2026-1502 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-12781 CVE-2025-12781 in python3.11 - Patched by Root
Root has patched CVE-2025-12781 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...