CVE-2026-51153: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/ /run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from t...

Malicious code in api-util (npm)

The package api-util was found to contain malicious code...

MAL-2025-14648 Malicious code in api-util (npm)

The package api-util was found to contain malicious code...