3148 matches found
EUVD-2026-75161
A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...
CLSA-2026-1788807441 TuxCare security update for jquery-mobile (1 CVE)
TuxCare rebuilt jquery-mobile to address 1 CVE. Fixed in 1.4.5-tuxcare.1...
PT-2026-95202
TuxCare rebuilt jquery-mobile to address 1 CVE. Fixed in 1.4.5-tuxcare.1...
CVE-2026-3853
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...
CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...
EUVD-2026-71886
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...
Malicious code in cxp-jquery (npm)
Source: checkmarx b0e4725a2db5433915386ce19dadd7812b0f44e9afcb7c48d855797cf7a78537 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...
jQuery File Upload RCE (CVE-2018-9206)
Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...
Malicious code in atlassian-plugins-jquery (npm)
Source: ossf-package-analysis fa70e76a995c21512e5537f8ba45c8143816593a98f504f5ac88ad3e752d9eaa The OpenSSF Package Analysis project identified 'atlassian-plugins-jquery' @ 0.0.0-dev npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...
Malicious code in apachecn-jquery-zh-pt2 (npm)
The package apachecn-jquery-zh-pt2 was found to contain malicious code. --- Credit: OpenSSF source...
be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-76984 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)
org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...
be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.4, <=3.1.7) +176 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=9.0.0, <=9.23.0)
org.apache.wicket:wicket-extensions MAVEN version =9.0.0, =1.3.1.release, =3.0.4, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.23.1 and more Source cves: CVE-2026-76985https://vulne...
be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.4, <=3.1.7) +376 more potentially affected by CVE-2026-76983 via org.apache.wicket:wicket-core (>=9.0.0, <=9.23.0)
org.apache.wicket:wicket-core MAVEN version =9.0.0, =1.3.1.release, =3.0.4, =3.0.4, =9.0.0, =9.0.0, =9.0.0, =9.18.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.23.1 and more Source cves: CVE-2026-76983 Source advisor...
AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4
Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...
CLSA-2026-1787920316 TuxCare security update for jquery (7 CVEs)
TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.3-tuxcare.1...
CLSA-2026-1787920143 TuxCare security update for jquery (8 CVEs)
TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1...
CLSA-2026-1787916782 TuxCare security update for jquery (7 CVEs)
TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.1-tuxcare.1...
towaos-lab-cve-2020-11023
CVE-2020-11023 - Vulnerabilidade XSS no jQuery Payloads de ataque root@kitploit: alert1 root@kitploit: Medidas de mitigação ⚠️ Importante : o uso de .html não é totalmente evitado apenas com jQuery 1. Usar o método .text ⭐️Recomendado root@kitploit: // Seguro: não é interpretado como HTML...