@whalent/agent (0.3.240) potentially affected by unknown CVE via @whalent/agent-core (0.3.240)

@whalent/agent-core NPM version 0.3.240 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.240 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

Arbitrary Code Injection

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Arbitrary Code Injection via the /nuxtisland/ endpoint when vue.runtimeCompiler is enabled and a server island component forwards attacker-controlled props into Vue's dynamic...

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.4.0, 3.21.10...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

EUVD-2026-53647

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

DEBIAN-CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71314

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

DEBIAN-CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

UBUNTU-CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

UBUNTU-CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +14 more potentially affected by CVE-2026-71316 via nuxt (>=4.4.2, <=4.5.0)

nuxt NPM version =4.4.2, =3.2.0, =1.4.4, =1.2.1, =1.6.0-rc.3, =1.0.0-alpha.1, =0.15.0, =0.1.0, =4.3.1-dev.1, =1.0.0, =0.6.0-rc.1, =0.2.0-alpha.5, =1.0.0-alpha.1, =1.0.0-alpha.20 and more Source cves: CVE-2026-71316 Source advisory: OSV:GHSA-WM8W-6QJM-CV43...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...

EUVD-2026-53646

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...

EUVD-2026-53645

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71314

Nuxt (Vue.js framework) is affected by CVE-2026-71314 in versions 3.1.0 through 3.21.10 and 4.5.1. An unauthenticated attacker can trigger unbounded server-side rendering memory growth via a server island v-for prop (including vforToArray and related usage), leading to memory exhaustion and a Nux...

CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

EUVD-2026-53643

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...