CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

CVE-2026-84665

The Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier is vulnerable to a stored cross-site scripting (XSS) issue. The root cause is a failure to limit URL schemes for dashboard links created from SonarQube scanner results, which allows the use of the javascript: scheme. Attackers with I...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the "javascript:" scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure...

EUVD-2026-70131

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84649

The Stapler component (versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, excluding 2088.2093.vd7c3e58008a_6) included in Jenkins versions 2.447 through 2.579 and LTS 2.452.1 through 2.568.2 contains a vulnerability where an HTTP endpoint serving dynamically generated JavaScript resource...

CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

EUVD-2026-70115

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

Prototype Pollution

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...

GHSA-G3HC-697W-WM82 Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...

Malicious code in archaeometry-javascript-jsonp-isostasy (npm)

The package archaeometry-javascript-jsonp-isostasy was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in aquarius-testcafe-javascript-lacerta (npm)

Source: amazon-inspector d916d270b6a4a30cb5d9c84f5f5957e2ab6e0ec71b3e40b044afb34ddf330270 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-cluster-ursa-javascript (npm)

Source: amazon-inspector 0d84a4b00a7033fc3fa3800a11c657e0a534a6b461ccf0deda2a4f531f6b3468 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview bella-serimuka92-kuki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...