CandidATS 3.0.0 - Cross-Site Scripting

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the page parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

avalagent (1.0.0), browser-use-undetected (>=0.2.5, <=0.2.5.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.23)

langchain-openai PYPI version 0.3.23 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - avalagent 1.0.0 - browser-use-undetected =0.2.5, =0.2.10, =0.0.7, =3.2.1, =3.2.5 Source cves: CVE-2026-41488 Source advisory:...

avalagent (1.0.0), browser-use-undetected (>=0.2.5, <=0.2.5.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.23)

langchain-openai PYPI version 0.3.23 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - avalagent 1.0.0 - browser-use-undetected =0.2.5, =0.2.10, =0.0.7, =3.2.1, =3.2.5 Source cves: CVE-2026-41488 Source advisory:...