375 matches found
EUVD-2026-107411
Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering...
npm: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
npm: Astro: Reflected/Stored XSS via unescaped / tag content in JSX/MDX rendering vulnerability discovered by ? in WordPress npm astro versions 7.3.2...
CVE-2026-114128
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
CVE-2026-114128
The Astro web framework is vulnerable to Reflected/Stored Cross-Site Scripting (XSS) in versions prior to 7.3.2 . The JSX and MDX rendering pipeline (specifically the astro:jsx renderer ) fails to distinguish between compiler-generated literal content and dynamic expression values within script a...
CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values. An application that passes...
PT-2026-120731
Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.3.2 Description The JSX and MDX rendering pipeline in the astro:jsx renderer treats string children of script and style elements as trusted HTML. It fails to distinguish between compiler-generated literal content and...
CLSA-2026-1792364009 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 16.0.6-tuxcare.4...
CLSA-2026-1792364002 TuxCare security update for @next/mdx (13 CVEs)
TuxCare rebuilt @next/mdx to address 13 CVEs. Fixed in 13.5.11-tuxcare.14...
CLSA-2026-1792364004 TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 16.0.6-tuxcare.7...
CLSA-2026-1792363988 TuxCare security update for @next/mdx (9 CVEs)
TuxCare rebuilt @next/mdx to address 9 CVEs. Fixed in 14.2.35-tuxcare.5...
CLSA-2026-1792363986 TuxCare security update for @next/mdx (2 CVEs)
TuxCare rebuilt @next/mdx to address 2 CVEs. Fixed in 12.3.7-tuxcare.8...
CLSA-2026-1792363969 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 15.5.26-tuxcare.1...
CLSA-2026-1792363967 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 15.5.24-tuxcare.1...
CLSA-2026-1792363966 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 15.5.23-tuxcare.1...
CLSA-2026-1792363964 TuxCare security update for @next/mdx (1 CVE)
TuxCare rebuilt @next/mdx to address 1 CVE. Fixed in 15.5.25-tuxcare.1...
EUVD-2026-102080
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
CVE-2026-108116 MDX and SOAP Injection in Kendo UI for jQuery
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
CVE-2026-108116
In Progress Kendo UI for jQuery versions prior to v2026.3.1015 are vulnerable to MDX and SOAP injection. The issue resides in the PivotGrid XMLA transport , where specially crafted filter values can alter MDX predicates or inject XML markup into SOAP requests. This vulnerability could lead to the...
CVE-2026-108116: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...