170245 matches found
GHSA-WM8W-6QJM-CV43 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves //payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...
GHSA-HXCR-HM88-MPQ6 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...
Security update for evince
This update for evince fixes the following issue: CVE-2026-63729: texlive: heap use-after-free in synctexparser.c via a malformed .synctex or .synctex.gz file bsc1272433. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...
CVE-2026-8709
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
ROOT-APP-PYPI-CVE-2024-3772 CVE-2024-3772 in pydantic - Patched by Root
Root has patched CVE-2024-3772 in the pydantic package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-25577 CVE-2023-25577 in Werkzeug - Patched by Root
Root has patched CVE-2023-25577 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in Jinja2 - Patched by Root
Root has patched CVE-2024-56201 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in Jinja2 - Patched by Root
Root has patched CVE-2025-27516 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-22195 CVE-2024-22195 in Jinja2 - Patched by Root
Root has patched CVE-2024-22195 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
CVE-2026-8709
Progress MarkLogic Server contains an improper privilege management vulnerability in the REST API document patch operation. An authenticated user with a low-privileged REST role can escalate privileges and perform privileged operations against the Security database. Affected versions are before 1...
CVE-2026-8709
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
EUVD-2026-53425
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
GHSA-JX35-X7FJ-VGPR Ghost Content API filter bypass reveals private fields
Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...
Ghost Content API filter bypass reveals private fields
Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...
Ghost: Cross-Site Scripting in Feature Image Captions
Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...
ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root
Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...