GHSA-X6QJ-4H56-5RJ5 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Summary This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address e.g. nuxt dev --host and the developer opens a malicious site on the same network. Details The fix for...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56317 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56317 Source advisory: OSV:GHSA-M3Q2-P4FW-W38M...

CVE-2026-55091

creationtimestamp| type| source ---|---|--- 2026-06-16 22:51:04+00:00| published-proof-of-concept| https://github.com/joaonuno/flat-to-nested-js/security/advisories/GHSA-hp36-v28f-w3r4...

GHSA-7CX2-G3H9-382P

creationtimestamp| type| source ---|---|--- 2026-06-16 21:41:28+00:00| seen| https://gist.github.com/alon710/d499538761d587fbb74d51e5882b31ec...

CVE-2026-54905

creationtimestamp| type| source ---|---|--- 2026-06-16 21:35:27+00:00| published-proof-of-concept| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-wv3x-4vxv-whpp...

CVE-2026-54904

creationtimestamp| type| source ---|---|--- 2026-06-16 21:35:21+00:00| published-proof-of-concept| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj 2026-06-24 21:35:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2ungvwp42p 2026-07-20...

CVE-2026-54906

creationtimestamp| type| source ---|---|--- 2026-06-16 21:35:12+00:00| published-proof-of-concept| https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-6wx8-w4f5-wwcr...

GHSA-VMF3-W455-68VH

creationtimestamp| type| source ---|---|--- 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-WGPF-JWQJ-8H8P

creationtimestamp| type| source ---|---|--- 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-H67P-54HQ-RP68

creationtimestamp| type| source ---|---|--- 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5 2026-09-03 19:24:14+00:00| seen| https://gist.github.com/konard/05d19a59942ef51514e30abcc55dbc13 2026-09-03 20:24:10+00:00| seen|...

EUVD-2026-37141

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the...

GHSA-8988-4F7V-96QF

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-J6C9-X7QJ-28XF

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-RV63-4MWF-QQC2

creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...

GHSA-F989-C77F-R2CQ

creationtimestamp| type| source ---|---|--- 2026-06-16 21:11:18+00:00| seen| https://gist.github.com/alon710/ea8299cfda138a4a029849fc1be10207...

GHSA-9CR8-Q42Q-G8M7 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Summary There is a critical vulnerability in Traefik's HTTP/3 QUIC TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact,...

CVE-2026-55388

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:59+00:00| published-proof-of-concept| https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg 2026-06-22 16:44:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116794762930791425 2026-06-22...

CVE-2026-35296

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1923 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-18 07:07:08+00:00| seen|...

GHSA-M6FH-WVW4-4629 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, seaweedfs, seaweedfs-fips, mattermost-fips, seaweedfs-rocksdb-fips, seaweedfs-operator-fips, seaweedfs-operator, seaweedfs-rocksdb...

GHSA-9X8Q-7H8H-WCW9 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-13.0, awx, metaflow-service-fips, open-webui, dask-kubernetes-fips, mlflow, authentik, py3-vllm-cuda-13.0, py3-vllm-cuda-12.4, airflow-core, py3-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-12.9, airflow, request-1276,...