CVE-2026-71189 Toptech TMS7 and TopHAT Cross-site Scripting

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-102328

A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=560536732 https://code.google.com/p/chromium/issues/detail?id=102328...

CVE-2026-102830

A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...

DEBIAN-CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

GHSA-HJ66-6F7G-4R5V Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

@adeweb-be/volto-leaflet-block (0.2.0), @bookjane2/bookjane-design-library (>=10.0.6, <=10.0.7) +43 more potentially affected by CVE-2026-97711 via serialize-javascript (>=7.0.0, <=7.1.1)

serialize-javascript NPM version =7.0.0, =10.0.6, =0.0.0-FEC-1017-shell-splitter-region-20260615151229, =0.0.0-canary-20260416134143, =1.0.5, =0.5.3, =0.3.6, =0.4.6, =0.3.7, =0.4.6, =0.21.0, =0.0.29, =1.23.0-beta.0, =1.23.0-beta.0, =1.23.0-beta.0, =1.24.0-rc.0 and more Source cves: CVE-2026-97711...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a regex flaw in SCRIPTCLOSEREGEXP that allows a live tag to survive...

CVE-2026-97711

A flaw was found in serialize-javascript. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying crafted function code containing unescaped script-closing tags. When the serialized function is embedded within an HTML script element, the unescaped tag...

DEBIAN-CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-102630

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...

CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

UBUNTU-CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...

CVE-2026-97711

The serialize-javascript library is vulnerable to cross-site scripting (XSS) in versions 7.1.1 through 7.1.2 . The root cause is that the SCRIPT_CLOSE_REGEXP can consume a second closing tag within a single match, failing to fully protect serialized function values against script-closing tags. If...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...