EUVD-2026-54580

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2026-71320

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When vue.runtimeCompiler: true is enabled off by default and the application has a server island component that forwards props into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can inject a...

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.4.0, 3.21.10...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320

Nuxt (Vue.js framework) has a vulnerability affecting versions 3.4.0–3.21.10 and 4.5.1 where an attacker can inject a template key via /__nuxt_island/ props into a dynamic component if vue.runtimeCompiler is enabled, leading to template execution in the Nitro process. This is fixed in 3.21.10 and...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

MGASA-2026-0311 Updated libxfont2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow. CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow. CVE-2026-56002 computeProps Property Buffer Heap Buffer Overflow. CVE-2026-56003...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the renderHTMLElement function. An attacker can inject arbitrary event-handler attributes or sibling...

GHSA-F48W-9M4C-M7F5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Summary The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names containing "' /= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement in packages/astro/src/runtime/server/render/dom.ts, has it...

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

GHSA-7PW4-F3Q4-R2P2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

PT-2026-61809

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6 Description A cross-site scripting XSS issue exists when the software is used with an SSR runtime that exposes a global HTMLElement such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node and a class extendi...

PT-2026-61807

Name of the Vulnerable Software and Affected Versions Astro versions 3.10.0 through 7.0.3 Description Astro fails to HTML-escape values for specific transition directives when applied to client-hydrated components. This occurs within the generateHydrateScript function, where the transition:persis...

Important: libXfont2

Issue Overview: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow CVE-2026-56002 computeProps Property Buffer Heap Buffer Overflow CVE-2026-56003 Affected Packages: libXfont2 Issue Correction: Run dnf update libXfont2 --releasever...

SUSE-SU-2026:22614-1 Security update for libXfont2

This update for libXfont2 fixes the following issues - CVE-2026-56001: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow bsc1269018. - CVE-2026-56002: PCF Font Parsing Heap Buffer Overflow bsc1269019. - CVE-2026-56003: computeProps Property Buffer Heap Buffer Overflow bsc1269020...

CVE-2026-57451

A flaw in Vim allows an attacker to cause a Denial of Service DoS via an application crash. If a user opens a maliciously crafted undo file, an out-of-bounds read is triggered in the gettextprops function due to missing length validation on property counts. Mitigation Users are advised to avoid...