@antv/g-mobile-svg (>=1.0.0 <=1.0.46), @antv/g-plugin-rough-svg-renderer (>=2.0.0 <=2.0.47) +3 more potentially affected by unknown CVE via @antv/g-plugin-svg-renderer (>=2.0.0 <=2.4.1)

@antv/g-plugin-svg-renderer NPM version =2.0.0, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.46 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3954...

Malicious code in @antv/g-plugin-svg-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/g-plugin-zdog-svg-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

CVE-2026-45346

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31...

CVE-2026-45346 Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31...

CVE-2026-45346

Open WebUI (self-hosted offline AI platform) prior to version 0.6.31 contains a stored Cross‑Site Scripting (XSS) vulnerability in its SVG renderer. The issue allows attackers to save and execute injected HTML/JavaScript in the application context, potentially leading to data exposure or manipula...

CVE-2026-45346 Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31...

EUVD-2026-30651

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31...

Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

Summary There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. Details It is possible permanently save any HTML/JavaScript code in the application, which can be then executed in the context of the application domain. This behaviour can be used to extract and stea...

PT-2026-41176

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.31 Description A Cross-Site Scripting issue exists in the SVG renderer implementation. This allows the permanent storage of HTML or JavaScript code within the application, which is then executed in the context ...

EUVD-2020-1459

Malware in sbrugna...

EUVD-2022-0612

Malicious code in bioql PyPI...

CVE-2024-23642

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2020-27428

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...

GeoServer < 2.23.4 Multiples Vulnerabilities

According to its banner, the version of GeoServer running on the remote host is prior to 2.23.5 or 2.24.0 prior to 2.24.2. It is, therefore, affected by Multiples Vulnerabilities : - An Arbitrary file upload vulnerability in REST Coverage Store API - A Stored Cross-Site Scripting XSS vulnerabilit...

CVE-2024-23642 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-23642 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

@cybergenios/scratch-gui (>=1.8.20 <=1.8.30), @cybergenios/www (>=1.0.2 <=1.0.3) +47 more potentially affected by CVE-2020-27428 via scratch-svg-renderer (>=0.1.0-prerelease.20180524210316 <=0.2.0)

scratch-svg-renderer NPM version =0.1.0-prerelease.20180524210316, =1.8.20, =1.0.2, =1.3.0, =0.1.0-raspberrypifoundation.20210805151219, =0.1.0, =1.0.0-alpha.1, =0.0.1, =0.1.0, =0.0.1, =3.0.10, =0.1.0, =0.1.1 and more Source cves: CVE-2020-27428 Source advisory: OSV:GHSA-H3VQ-WV8J-36GW...

Cross-site Scripting in Scratch-Svg-Renderer

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...

GHSA-H3VQ-WV8J-36GW Cross-site Scripting in Scratch-Svg-Renderer

A DOM-based cross-site scripting XSS vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file...