CVE Vulnerability Catalog

In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, as well as in @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, enabling the experimental.componentIslands option caused .server.vue files under pages/ to be automatically registered as server islands. Requests through the /__nuxt_island/:name endpoint rendered the page component directly without instantiating Vue Router, resulting in route middleware not running.

In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, as well as in @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders island components without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs. This issue has been patched in versions 3.21.6 and 4.4.6.

In versions @nuxt/rspack-builder and @nuxt/webpack-builder from 3.15.4 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during development when the dev server is bound to a non-loopback address.

Nuxt is a web development framework that in versions from 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 has an issue with the navigateTo() function. Using external: true generates an HTML redirect with a <meta http-equiv="refresh"> tag, allowing for injection of malicious code.

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. The use of Perl's built-in eq comparison may allow an attacker to guess the underlying derived key by analyzing timing discrepancies.

Quest Bot is an open-source Discord bot that, prior to version 1.1.8, allowed users to repeatedly create new ticket channels without restrictions. The latest version still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking if the same user already has an open ticket.

The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain partial system configuration information.

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified signature entry, and may affect downstream JAX-RS entity parsing or signed-header consistency checks. Upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing CR and LF characters. If an attacker controls the realm value, they can inject arbitrary HTTP headers or split the response. Upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into server log files. Upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the security context check, the introspection endpoint can be accessed by any unauthenticated network attacker. Note this is a safeguard only if someone forgot to enable authentication. Upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

A flaw in QEMU's virtio-blk device fails to validate input descriptor sizes before writing data. A privileged guest can submit a malformed SCSI request, causing an out-of-bounds write on the host heap memory.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal vulnerability, allowing authenticated remote attackers to exploit this vulnerability to create directories in unintended system paths.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Read vulnerability, allowing privileged remote attackers to access files outside the intended directory scope.

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.

Vulnerability CVE-2026-9271 affects a specific component that may be susceptible to attacks. In particular, it could lead to unauthorized access or data disclosure.

Heptabase developed by Hepta Platforms has an Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions.

CVE-2026-48613 describes an SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data. This allows for the execution of arbitrary SQL queries on phpBB forums that were updated from versions prior to phpBB 3.3.8 and have not yet been updated to 3.3.11 or newer.

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.