CVE-2026-128076 is a low-severity vulnerability in the @nuxt nitro-server framework affecting versions from 3.21.6 up to but not including 4.0.0 and from 4.4.6 up to but not including 4.6.4. It involves improper encoding or escaping of output in the /__nuxt_island path hash, which uses ohash serialization that does not escape quotes in string values or delimiters in object keys. This flaw allows different island-prop tuples to produce the same path, potentially leading to content substitution or script execution if unsafe HTML sinks like v-html or innerHTML are used. The issue is fixed in version 4.6.4.
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (__NUXT_DATA__) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4.
A regular expression inefficiency in Nuxt versions 4.6.0 through 4.6.3 causes the Node.js event loop to be synchronously blocked by long runs of slash characters in certain URL paths. This affects server-side rendering when using isr, swr, cache route rules, or the experimental early-404 feature, leading to availability delays. Fully prerendered or client-only applications and those not using the specified route rules or features are not impacted. The issue is resolved in version 4.6.4.
A vulnerability in Nuxt development middleware versions from 3.0.0 and 3.12.2 up to but not including 4.6.4 allows an attacker to bypass origin validation under specific conditions. This issue arises when the Host header names an attacker-controlled hostname, which after DNS rebinding resolves to a loopback address. An attacker can then access client JavaScript chunks and inline source maps, potentially exposing compiled source code, local filesystem paths, and developer-controlled values. The vulnerability requires the attacker to know or guess the development server port and trick the developer into opening a malicious page. The default Vite builder and production builds are not affected. The issue is fixed in Nuxt version 4.6.4.
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.
A vulnerability in Nuxt versions from 3.0.0 up to but not including 4.6.4 allows an unauthenticated request to bypass certain route rules due to inconsistent handling of encoded slashes (%2F) in request paths. This leads to incomplete application of redirect, headers, proxy, SSR, and other route rules for decoded paths in multi-segment or catch-all routes. The issue is fixed in version 4.6.4.
CVE-2026-129139 is a vulnerability in the itwanger paicoding product where accounts created via ZSXQ login use predictable credentials. The username and password are both derived solely from the member's ZSXQ number, which can be read by unauthenticated attackers from the victim's profile page. This allows attackers to compute the credentials and log in to the victim's account without authentication.
paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files that can contain embedded scripts. When these SVG images are stored locally and served from the site origin, authenticated attackers can upload malicious SVGs that execute scripts in the context of other users viewing them. This can lead to theft of non-HttpOnly session cookies and account hijacking.
paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability. The SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. Authenticated attackers can inject a closing script tag and arbitrary HTML into their profile, enabling script execution in the context of visitors viewing that profile page. This can lead to theft of non-HttpOnly f-session cookies.
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
paicoding version 1.0.3 has a missing authorization vulnerability in its ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to access restricted articles, including paid, login-only, member-only, and draft content, by enumerating article IDs via a GET request.
paicoding version 1.0.3 has a payment bypass vulnerability that allows authenticated attackers to unlock paid articles without completing payment. The flaw arises from a small space of random payment confirmation codes, enabling attackers to guess valid codes by enumerating approximately 2000 counter values and submitting matching verification codes to an unauthenticated callback endpoint to mark payments as completed.
SurveyKing version 1.13.2 has a missing authorization vulnerability in its result lookup feature. This flaw allows unauthenticated attackers with access to a public survey link to bypass password checks and retrieve complete survey responses, including hidden fields, by exploiting a wildcard injection in the MyBatis LIKE condition.
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.
SurveyKing versions 1.12.0 through 1.13.2 have an authorization bypass vulnerability in the linked survey feature. This flaw allows authenticated users to manipulate the linked survey ID to access and modify survey responses belonging to other users. The vulnerability arises because the system does not verify that the linked survey ID belongs to the caller's own project.
SurveyKing versions 1.13.0 through 1.13.2 have a stored cross-site scripting (XSS) vulnerability. This occurs because the server accepts survey snapshots supplied by respondents, and the frontend renders snapshot titles using innerHTML without proper neutralization. An anonymous respondent can submit a crafted snapshot containing malicious event handlers, such as img onerror, which execute in an administrator's browser when viewing the response.
DjangoBlog versions 2.0.0.0 through 2.1.0.0 are affected by a stored cross-site scripting (XSS) vulnerability. The issue arises because the comment sanitizer improperly allows event-handler attributes such as autofocus and onfocus on certain HTML tags. Authenticated users can exploit this by posting specially crafted comments that execute scripts automatically when viewed by others, including administrators.
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController. This flaw allows any authenticated user to access and view all users' RAG traces, including sensitive details such as usernames, user IDs, conversation IDs, questions, and execution details for each node. The vulnerability enables unauthorized data exposure by paging through specific endpoints.
ragent version 1.1.0 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload SVG files with embedded scripts via the knowledge base document upload endpoint. When other users view these SVG files served inline, the malicious scripts execute in the context of the application, potentially leading to account takeover.