74049 matches found
GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact
Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...
Incomplete List of Disallowed Inputs
Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...
EUVD-2026-42324
OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header...
CVE-2026-44228
A flaw was found in RT, an issue and ticket tracking system. This stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript code into the system. When another user views the affected page, the injected script executes, potentially leading to...
AutoBugBounty
AutoScan — Legendary Bug Bounty Automation Framework ▄█...
GHSA-8WHX-365G-H9VV Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...
CVE-2026-46681
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...
CVE-2026-16410
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
CVE-2026-16392
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
CVE-2026-16369
Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16368
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16355
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16363
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16363
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
UBUNTU-CVE-2026-16369
Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
UBUNTU-CVE-2026-16392
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
UBUNTU-CVE-2026-16363
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...