EUVD-2026-118396

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup...

CVE-2026-62345

The Wanderer self-hosted trail database is vulnerable to Stored XSS in versions prior to 0.19.3 . An authenticated user can provide a crafted waypoint.icon value which is then passed into createMarkerFromWaypoint() and subsequently injected into the map marker markup via insertAdjacentHTML withou...