AZL-103439 CVE-2026-93690 affecting package js-jquery 3.5.0-4

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

PT-2026-95343

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.24.1 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

Malicious code in jquery-ui.ruler (npm)

The package jquery-ui.ruler was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-validation-utils (npm)

--- Credit: OpenSSF source...

Malicious code in jquery-impromptu (npm)

The package jquery-impromptu was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-app-banner (npm)

The package jquery-app-banner was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-tools (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

Malicious code in jquery-display (npm)

Source: amazon-inspector a0873d8250c8747e1115c2866076509122f7e9ea8f4dde4dca4920d0f31f4874 The package jquery-display was found to contain malicious code. Source: ossf-package-analysis a467cf539f97f5439ab6ce7200d492d507d89b51ed9b63a60baa47bed56e6d01 The OpenSSF Package Analysis project identified...

Malicious code in jquery-overscroll (npm)

Source: ossf-package-analysis 279b9014e86c11c82ac819b5e3bbbbbfc2868e3131b65bd941e60d08985cfbb0 The OpenSSF Package Analysis project identified 'jquery-overscroll' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in jquery-double-tap-to-go (npm)

The package jquery-double-tap-to-go was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-ui-custom (npm)

--- Credit: OpenSSF source...

Malicious code in jquery-ui-slider-pips (npm)

The package jquery-ui-slider-pips was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-2.1 (npm)

The package jquery-2.1 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-ui-i18n (npm)

The package jquery-ui-i18n was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-impromtu (npm)

--- Credit: OpenSSF source...

Malicious code in jquery-easing-original (npm)

--- Credit: OpenSSF source...

Malicious code in jquery-poolparty (npm)

The package jquery-poolparty was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jquery-ui-dialog (npm)

Source: ossf-package-analysis f1ac81ca06088c1af7f942bcd5c3e05a81ee19ded09f4417b8eea369da63f3c3 The OpenSSF Package Analysis project identified 'jquery-ui-dialog' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...