nuxt content vulnerabilities

Latest nuxt content CVEs

Newest publication first

1. CVE-2026-102650 Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

   Published 2026-11-06

   High·CVSS 7.5 EPSS 0.35%

   Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits exp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.