Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,799 results · page 3 of 56
Oct 21, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-113796 · Other software · electron · reported by GitHubMedium 4.2
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript.CVE-2026-113787 · Other software · GitHubNewbie0 · reported by GitHubMedium 6.1
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vert
- Product
- odf-kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads.CVE-2024-5139 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 6.1
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
- Product
- WSO2 Enterprise Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause viaCVE-2026-114396 · Other software · polonel · reported by VulnCheckHigh 7.1
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
- Product
- trudesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026User Profile Builder: Does not escape the current page URL before outputting it in a JavaScript context on one of its admin pagesCVE-2026-111948 · WordPress plugins & themes · reported by WPScanHigh 7.1
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
- Product
- User Profile Builder
- Fixed in
- 4.0.1
- What to do
- Update User Profile Builder to 4.0.1 or newer.
Oct 20, 2026Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.CVE-2026-112950 · Other software · vitest-dev · reported by GitHubMedium 5.9
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev server on Windows and register a redirect mock containing backslash traversal, POSIX joining preserves a Windows backslash traversal that the later filesystem read interprets as a path separator, so the client can read a file outside server.fs.allow that the Vitest process can access. This issue is fixed in versions 4.1.12 and 5.0.3.
- Product
- vitest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vitest is a Vite-native testing framework for JavaScript and TypeScript projects.CVE-2026-112949 · Other software · vitest-dev · reported by GitHubMedium 4.7
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.
- Product
- vitest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-112947 · Other software · vitejs · reported by GitHubMedium 6.3
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-112946 · Other software · vitejs · reported by GitHubMedium 6.3
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vite is a frontend tooling framework for JavaScript.CVE-2026-112945 · Other software · vitejs · reported by GitHubLow 2.1
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
- Product
- vite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by craftCVE-2026-113583 · Other software · cypht-org · reported by VulnCheckMedium 5.3
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
- Product
- cypht
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed linkCVE-2026-113355 · Other software · chatwoot · reported by VulnCheckMedium 4.8
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fieCVE-2026-113350 · Other software · marmelab · reported by VulnCheckMedium 5.1
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
- Product
- react-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-111757 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026WP Photo Album Plus: Does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb linksCVE-2026-110981 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.11.002
- What to do
- Update WP Photo Album Plus to 9.2.11.002 or newer.
Oct 16, 2026Flying Scripts: Delay JavaScript to Improve Site Speed & Performance: Stored Cross-Site ScriptingCVE-2026-109990 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.
- Product
- Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Flying Scripts: Delay JavaScript to Improve Site Speed & Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026libp2p is a JavaScript implementation of the libp2p networking stack.CVE-2026-103936 · Other software · libp2p · reported by GitHubHigh 7.5
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.
- Product
- js-libp2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-101897 · Other software · angular · reported by GitHubMedium 5.1
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-101896 · Other software · angular · reported by GitHubHigh 8.2
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected. This issue is fixed in versions 20.3.32, 21.2.24, and 22.2.0.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-101895 · Other software · angular · reported by GitHubHigh 8.7
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.
- Product
- angular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails.CVE-2026-101025 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.9
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX JavaScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalizatioCVE-2026-101019 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.3
Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issu
- Product
- NGINX JavaScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Qwik is a performance-focused JavaScript framework.CVE-2026-84994 · Other software · QwikDev · reported by GitHubHigh 8.7
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object whose then property is a QRL for an unregistered symbol, causing an orphaned asynchronous rejection that terminates Node.js under its default unhandled-rejection policy. A single request can crash a server, and repeated requests can keep replicas unavailable. This issue is fixed in @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37.
- Product
- qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2026-102672 · Other software · electron · reported by GitHubMedium 6.7
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a CVE-2026-109960 · Other software · froxlor · reported by VulnCheckHigh 8.7
Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings.
- Product
- froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-109761 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-109749 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-109748 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026JIT miscompilation in the JavaScript Engine: JIT component.CVE-2026-109733 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Use-after-free in the JavaScript Engine: JIT component.CVE-2026-109729 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026JIT miscompilation in the JavaScript Engine: JIT component.CVE-2026-109722 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Incorrect boundary conditions in the JavaScript Engine: JIT component.CVE-2026-109721 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026JIT miscompilation in the JavaScript: WebAssembly component.CVE-2026-109720 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.1
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Incorrect boundary conditions in the JavaScript Engine component.CVE-2026-109716 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Incorrect boundary conditions in the JavaScript Engine component.CVE-2026-109715 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 13, 2026Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in FirCVE-2026-103418 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 12, 2026IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map filCVE-2026-75076 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.
- Product
- Aspera Enterprise WebApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.CVE-2026-75063 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
- Product
- Planning Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that coCVE-2026-85965 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in thCVE-2026-48212 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.8
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disabCVE-2026-108852 · Other software · OvidijusParsiunas · reported by VulnCheckLow 2.1
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
- Product
- Deep Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by CVE-2026-108551 · Other software · ferdikoomen · reported by VulnCheckCritical 9.3
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.
- Product
- openapi-typescript-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.CVE-2026-94448 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments witCVE-2026-107801 · Other software · banq · reported by VulnCheckMedium 5.1
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share its link to run JavaScript on the application's origin for viewing users.
- Product
- jivejdon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get().CVE-2026-107700 · Other software · ntharim · reported by VulnCheckCritical 9.3
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.
- Product
- dot-access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 7, 2026An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's broCVE-2026-93684 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
- Product
- Apache Impala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 6, 2026StableLib is a stable library of useful TypeScript and JavaScript code.CVE-2026-106448 · Other software · StableLib · reported by GitHubHigh 8.9
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.
- Product
- stablelib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026StableLib is a stable library of useful TypeScript and JavaScript code.CVE-2026-106447 · Other software · StableLib · reported by GitHubHigh 8.7
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.
- Product
- stablelib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript.CVE-2026-106120 · Other software · harttle · reported by GitHubMedium 6
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.
- Product
- liquidjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js.CVE-2026-102282 · Other software · cthackers · reported by GitHubHigh 7.1
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue.
- Product
- adm-zip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.