CVE-2026-13323

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX...

CVE-2026-13323

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX...

CVE-2025-55620

Reolink version v4.54.0.4.20250526 is affected by a cross-site scripting (XSS) vulnerability within the valuateJavascript() function. The root cause is the improper handling of input by this function, which allows an attacker to execute arbitrary web scripts or HTML using a crafted payload. Impac...