CVE-2026-23929 Prototype pollution leading to stored XSS

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-23929

Zabbix's searchParamsToObject() function failed to filter dangerous properties like __proto__ from URL parameters, enabling prototype pollution that, combined with jQuery's unsafe element creation traversing the prototype chain, results in persistent XSS in Maps. CVSS 4.0 scores this HIGH (8.5) w...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

PT-2026-76956

Name of the Vulnerable Software and Affected Versions Maps affected versions not specified Description A prototype pollution issue exists in the searchParamsToObject function. The processing of URL parameters fails to filter dangerous properties such as proto . When combined with unsafe element...

CLSA-2026-1786361523 TuxCare security update for jquery (1 CVE)

TuxCare rebuilt jquery to address 1 CVE. Fixed in 3.3.1-tuxcare.2...

Malicious code in jquery.ui.tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84 [email protected] is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime index.js contains only...

Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

CLSA-2026-1784596271 TuxCare security update for jquery (1 CVE)

TuxCare rebuilt jquery to address 1 CVE. Fixed in 3.1.1-tuxcare.1...

CLSA-2026-1784164090 TuxCare security update for jquery (14 CVEs)

TuxCare rebuilt jquery to address 14 CVEs. Fixed in 3.3.1-tuxcare.1...

CLSA-2026-1784164088 TuxCare security update for jquery (3 CVEs)

TuxCare rebuilt jquery to address 3 CVEs. Fixed in 3.2.1-tuxcare.1...

CLSA-2026-1780361405 TuxCare security update for jquery (4 CVEs)

TuxCare rebuilt jquery to address 4 CVEs. Fixed in 1.11.3-tuxcare.1...

CLSA-2026-1777336744 TuxCare security update for jquery (1 CVE)

TuxCare rebuilt jquery to address 1 CVE. Fixed in 1.8.2-tuxcare.2...

CLSA-2026-1773188127 TuxCare security update for jquery-ui (6 CVEs)

TuxCare rebuilt jquery-ui to address 6 CVEs. Fixed in 1.10.4-tuxcare.1...

CLSA-2026-1773188124 TuxCare security update for jquery (5 CVEs)

TuxCare rebuilt jquery to address 5 CVEs. Fixed in 2.2.4-tuxcare.1...

CLSA-2026-1773188123 TuxCare security update for jquery (4 CVEs)

TuxCare rebuilt jquery to address 4 CVEs. Fixed in 1.12.4-tuxcare.1...

CLSA-2026-1773188121 TuxCare security update for jquery (16 CVEs)

TuxCare rebuilt jquery to address 16 CVEs. Fixed in 1.8.2-tuxcare.1...

CLSA-2026-1773101701 TuxCare security update for jquery (5 CVEs)

TuxCare rebuilt jquery to address 5 CVEs. Fixed in 3.4.1-tuxcare.1...

CLSA-2026-1773101704 TuxCare security update for jquery-validation (5 CVEs)

TuxCare rebuilt jquery-validation to address 5 CVEs. Fixed in 1.19.0-tuxcare.1...

AZL-92192 CVE-2026-59869 affecting package js-jquery 3.5.0-4

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

PYSEC-2026-628 XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...