Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /system/notice/add interface. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting malicious scripts into input fields processed by this interface. Details...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /system/notice/add interface. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting malicious scripts into input fields processed by this interface. Details...

CVE-2026-48887

CVE-2026-48887 affects the WordPress JS Help Desk plugin ≤ 3.0.9 with an unauthenticated Broken Access Control flaw. Documents note unauthorized access control weakness but do not provide root cause details or a stated remediation; Patchstack is cited as the source. Exploitation status is not des...

EUVD-2026-36861

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

CVE-2026-48887 WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

EUVD-2026-36860

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

CVE-2026-48886

The CVE-2026-48886 entry describes an unauthenticated SQL Injection in WordPress JS Help Desk plugin versions

GHSA-9H5V-PFQQ-X599 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

Summary A regular expression denial-of-service ReDoS vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParserheaders.withClientHints, an attacker can cause the parser to spend excessive CPU...

@agentbadge/mcp (0.1.9), @agentbadge/passport (>=0.1.8, <=0.2.1) +75 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.8, =0.1.1, =0.1.1, =1.16.0, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.3.1, =0.1.0, =0.1.1 - @hiero-ledger/sdk 2.85.0 - @identikey/metacoding 0.2.0 and more Source cves: CVE-2026-54270 Source advisory: SNYK:JS-PROTOBUFJS-17353318...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2216 more potentially affected by unknown CVE via dompurify (>=3.0.0, <=3.4.7)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.4 and more Source cves: unknown CVE Source advisory: SNYK:JS-DOMPURIFY-17342528...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +8451 more potentially affected by CVE-2026-12143 via form-data (>=4.0.0, <=4.0.5)

form-data NPM version =4.0.0, =1.0.0, =1.2.0, =1.0.0, =0.1.0, =0.0.1, =0.1.1, =5.0.0, =0.0.1, =1.0.1, =1.0.32, =1.0.32, =1.1.11 and more Source cves: CVE-2026-12143 Source advisory: OSV:GHSA-HMW2-7CC7-3QXX...

CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

CVE-2026-12057

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

Cross-site Scripting

Nuxt is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation of URL schemes in the component, where attacker-controlled values supplied to the to or href props can contain javascript: or vbscript: URLs that are rendered directly into the underlying element,...

CVE-2026-12057

CVE-2026-12057 describes a vulnerability where JavaScript executed inside a PDF, while in a sandboxed application, can bypass some UI/danger-interface interception, allowing remote scripts to run and potentially cause arbitrary code execution. The NVD entry ties this to a high-severity impact (CV...

CVE-2026-12057 DoS + Remote Code Execution via PDF JavaScript in Foxit AI

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

EUVD-2026-36715

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

CVE-2026-12057 DoS + Remote Code Execution via PDF JavaScript in Foxit AI

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

CVE-2026-12208 jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible ...