GHSA-GFHX-HW2G-V5HG Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Impact serialize-javascript escapes its output so it is safe to embed inside a element. In 7.1.1 that guarantee does not hold for function values: a crafted function body can carry a literal, unescaped into the output, terminating the script element early so the remainder is parsed as HTML...

CVE-2026-60119

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the sequence, which is not escaped by JSON.stringify when...

EUVD-2026-2733

An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a block without HTML‑safe escaping, allowing to terminate the script and inject arbitrary JavaScript. This enables remote script execution in users' browsers, with potential for...

CVE-2021-21700

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...