Medium
CVE-2026-45669
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 54
Reset filters
Low
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
High
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
Critical
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Medium
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Medium
CVE-2026-34405
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes
Medium
ghsa-pqhr-mp3f-hrpp
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters
Medium
CVE-2026-34404
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions
Medium
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Medium
CVE-2026-31860
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
High
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
Medium
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Medium
CVE-2025-52662
Nuxt DevTools vulnerable to cross-site scripting (XSS)
Low
CVE-2025-59414
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
High
CVE-2025-54075
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
High
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
High
CVE-2025-27415
Nuxt allows DOS via cache poisoning with payload rendering response
Critical
CVE-2025-24981
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
Low
ghsa-r5w7-f542-q2j4
Potential DoS when using ContextLines integration
Medium
CVE-2025-24361
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Medium
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
High
CVE-2024-42352
Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
Critical
CVE-2024-34344
Nuxt vulnerable to remote code execution via the browser when running the test locally
Medium
CVE-2024-34343
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.