Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,799 results · page 13 of 56
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44293 · Other software · protobufjs · reported by GitHubHigh 7.7
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44292 · Other software · protobufjs · reported by GitHubMedium 5.3
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44291 · Other software · protobufjs · reported by GitHubHigh 8.1
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44290 · Other software · protobufjs · reported by GitHubHigh 7.5
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44289 · Other software · protobufjs · reported by GitHubHigh 7.5
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 13, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-44288 · Other software · protobufjs · reported by GitHubMedium 5.3
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. An attacker who can provide protobuf binary data decoded through the affected UTF-8 path may be able to bypass application-level checks that inspect raw bytes before protobuf string decoding. For example, bytes that do not contain certain ASCII characters could decode to strings containing those characters. This vulnerability is fixed in 7.5.6 and 8.0.2.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript byCVE-2020-37225 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
- What to do
- Update the plugin to the newest version.
May 12, 2026ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.CVE-2026-42338 · Other software · beaugunderson · reported by GitHubMedium 5.3
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
- Product
- ip-address
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
May 12, 2026Other issue in the JavaScript Engine component.CVE-2026-8391 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 12, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-8390 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.3
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 12, 2026JIT miscompilation in the JavaScript Engine: JIT component.CVE-2026-8389 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 12, 2026Incorrect boundary conditions in the JavaScript Engine: JIT component.CVE-2026-8388 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 11, 2026DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated uCVE-2026-45392 · Other software · Cribl · reported by af879a92-7297-456a-bb0e-905ac6c64bdcHigh 8.4
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a crafted URL and interacting with the page.
- Product
- Cribl Stream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cribl.iotrust.cribl.io
May 11, 2026An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user whoCVE-2026-7308 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.1
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
May 11, 2026Clerk JavaScript is the official JavaScript repository for Clerk authentication.CVE-2026-42349 · Other software · clerk · reported by GitHubHigh 7.6
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
- Product
- javascript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2026Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by enteCVE-2021-47929 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfilterable-portfolio.comwordpress.org
May 9, 2026LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.CVE-2026-41311 · Other software · harttle · reported by GitHubHigh 7.5
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.
- Product
- liquidjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-41423 · Other software · angular · reported by GitHubHigh 8.7
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8, a Server-Side Request Forgery (SSRF) vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering (SSR). When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine (Express, etc.) passes the URL string to Angular’s rendering functions. Because the URL parser normalizes the backslash to a forward slash for HTTP/HTTPS schemes, the internal state of the application is hijacked to believe the current origin is evil.com. This misinterpretation tricks the application into treating the attacker’s domain as the local origin. Consequently, any relative HttpClient requests or PlatformLocation.hostname references are redirected to the attacker controlled server, potentially exposing internal APIs or metadata services. This issue has been patched in versions 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.CVE-2026-41692 · Other software · i18next · reported by GitHubMedium 4.7
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.
- Product
- i18nextify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without sCVE-2026-41691 · Other software · i18next · reported by GitHubMedium 6.5
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \, ?, #, %, whitespace, and control characters; cap the length).
- Product
- i18next-http-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Math.js is an extensive math library for JavaScript and Node.js.CVE-2026-41139 · Other software · josdejong · reported by GitHubHigh 8.8
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
- Product
- mathjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.CVE-2026-41675 · Other software · xmldom · reported by GitHubHigh 8.7
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
- Product
- xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.CVE-2026-41674 · Other software · xmldom · reported by GitHubHigh 8.7
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
- Product
- xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.CVE-2026-41673 · Other software · xmldom · reported by GitHubHigh 8.7
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
- Product
- xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.CVE-2026-41672 · Other software · xmldom · reported by GitHubHigh 8.7
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
- Product
- xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled.CVE-2026-23928 · Other software · Zabbix · reported by security@zabbix.comHigh 7.3
The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maCVE-2026-23926 · Other software · Zabbix · reported by security@zabbix.comHigh 7.3
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications.CVE-2026-41686 · Other software · anthropics · reported by GitHubMedium 4.8
Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node.js default modes (0o666 for files, 0o777 for directories), leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior. This issue has been patched in version 0.91.1.
- Product
- anthropic-sdk-typescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by craCVE-2026-7429 · Other software · siteserver · reported by VulnCheckLow 2.1
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.
- Product
- SSCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage comCVE-2025-14576 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3High 7.4
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgaccess.redhat.com
Apr 29, 2026Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigCVE-2026-42523 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
- Product
- Jenkins GitHub Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.CVE-2026-42518 · Other software · CDAC-Noida · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
- Product
- e-Sushrut, Hospital Management Information System (HMIS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution wheCVE-2026-5362 · Other software · pimcore · reported by help@fluidattacks.comMedium 4.8
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Apr 24, 2026Clerk JavaScript is the official JavaScript repository for Clerk authentication.CVE-2026-41248 · Other software · clerk · reported by GitHubCritical 9.1
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
- Product
- astro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2026Math.js is an extensive math library for JavaScript and Node.js.CVE-2026-40897 · Other software · josdejong · reported by GitHubHigh 8.8
Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.
- Product
- mathjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026elFinder is an open-source file manager for web, written in JavaScript using jQuery UI.CVE-2026-41247 · Other software · Studio-42 · reported by GitHubHigh 8.9
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user. This vulnerability is fixed in 2.1.67.
- Product
- elFinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026reCaptcha by WebDesignBy: Does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() functionCVE-2026-4512 · WordPress plugins & themes · reported by WPScanLow 3.5
The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.
- Product
- reCaptcha by WebDesignBy
- Fixed in
- 2.0
- What to do
- Update reCaptcha by WebDesignBy to 2.0 or newer.
Apr 23, 2026Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that CVE-2026-3007 · Other software · Three Learning · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 5.4
Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.
- Product
- Koollab Learning Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.CVE-2026-6019 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rCVE-2026-3673 · Other software · Frappe · reported by help@fluidattacks.comMedium 4.6
An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping. This issue affects Frappe: 16.10.10.
- Product
- Frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Apr 22, 2026Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled CVE-2026-41469 · Other software · Beghelli · reported by VulnCheckMedium 5.1
Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript resources from attacker-controlled origins. When chained with the template injection and sandbox escape vulnerabilities present in the same application, the absence of CSP removes the browser-enforced restriction that would otherwise block external script execution, enabling attackers to load arbitrary remote payloads into operator browser sessions.
- Product
- SicuroWeb (Sicuro24)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code throughCVE-2024-58344 · Other software · 94Cb · reported by VulnCheckMedium 5.1
Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.
- Product
- Carbon Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Other issue in the JavaScript Engine component.CVE-2026-6779 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 21, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-6758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 21, 2026Invalid pointer in the JavaScript: WebAssembly component.CVE-2026-6757 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.3
Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 21, 2026Use-after-free in the JavaScript Engine component.CVE-2026-6754 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 18, 2026protobufjs compiles protobuf definitions into JavaScript (JS) functions.CVE-2026-41242 · Other software · protobufjs · reported by GitHubCritical 9.4
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
- Product
- protobuf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass CVE-2026-5758 · Other software · Mafintosh · reported by cret@cert.orgMedium 6.5
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.
- Product
- Protocol-buffers-schema parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commorielharush.github.io
Apr 14, 2026Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.CVE-2026-5752 · Other software · Cohere · reported by cret@cert.orgCritical 9.3
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
- Product
- cohere-terrarium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs.CVE-2026-27683 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact on confidentiality with no impact on integrity and availability.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.