Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,802 results · page 16 of 57

Mar 3, 2026Underscore.js is a utility-belt library for JavaScript.CVE-2026-27601 · Other software · jashkenas · reported by GitHubHigh 8.2
Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its
Product
underscore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 3, 2026The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via CVE-2021-35483 · Other software · Nokia · reported by MITREMedium 4.1
The Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JavaScript files via the /ui/rest-proxy/application fileupload parameter. This can occur during the adding of a new application, or during the editing of an existing one. If an authenticated user visits the web page where the file is published, the JavaScript code is executed.
Product
Impact
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it nokia.com
Mar 3, 2026A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated manaCVE-2026-3343 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 5.1
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
Product
Fireware OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.watchguard.com watchguard.com
Feb 28, 2026wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fieldsCVE-2026-28561 · WordPress plugins & themes · reported by VulnCheckMedium 4.8
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 25, 2026Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.CVE-2026-27970 · Other software · angular · reported by GitHubHigh 7.6
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization (i18n) pipeline. In ICU messages (International Components for Unicode), HTML from translated content was not properly sanitized and could execute arbitrary JavaScript. Angular i18n typically involves three steps, extracting all messages from an application in the source language, sending the messages to be translated, and then merging their translations back into the final source code. Translations are frequently handled by contracts with specific partner companies, and involve sending the source messages to a separate contractor before receiving final translations for display to the end user. If the returned translations have malicious content, it could be rendered into the application and execute arbitrary JavaScript. When successfully exploited, this vulnerability allows for execution of attacker controlled JavaScript in the application origin. Depending on the nature of the application being exploited this could lea
Product
angular
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 25, 2026minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.CVE-2026-27904 · Other software · isaacs · reported by GitHubHigh 7.5
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Product
minimatch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 25, 2026minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.CVE-2026-27903 · Other software · isaacs · reported by GitHubHigh 7.5
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can pla
Product
minimatch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 25, 2026Dottie provides nested object access and manipulation in JavaScript.CVE-2026-27837 · Other software · mickhansen · reported by GitHubMedium 6.3
Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.
Product
dottie.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 25, 2026Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2026-27700 · Other software · honojs · reported by GitHubHigh 8.2
Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, when using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header. Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled. This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed. Version 4.12.2 patches the issue.
Product
hono
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 24, 2026Enclave is a secure JavaScript sandbox designed for safe AI agent code execution.CVE-2026-27597 · Other software · agentfront · reported by GitHubCritical 10
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue has been fixed in version 2.11.1.
Product
enclave
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 24, 2026Rollup is a module bundler for JavaScript.CVE-2026-27606 · Other software · rollup · reported by GitHubHigh 8.8
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
Product
rollup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 24, 2026Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript.CVE-2026-27519 · Other software · Binardat Ltd. · reported by VulnCheckHigh 8.7
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protections.
Product
10G08-0800GSM Network Switch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record binardat.com vulncheck.com
Feb 24, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-2804 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Race condition in the JavaScript: GC component.CVE-2026-2802 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.2
Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Incorrect boundary conditions in the JavaScript: WebAssembly component.CVE-2026-2801 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript: GC component.CVE-2026-2797 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026JIT miscompilation in the JavaScript: WebAssembly component.CVE-2026-2796 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript: GC component.CVE-2026-2795 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript Engine component.CVE-2026-2786 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Invalid pointer in the JavaScript Engine component.CVE-2026-2785 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component.CVE-2026-2783 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript: WebAssembly component.CVE-2026-2767 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript Engine: JIT component.CVE-2026-2766 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript Engine component.CVE-2026-2765 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026JIT miscompilation, use-after-free in the JavaScript Engine: JIT component.CVE-2026-2764 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript Engine component.CVE-2026-2763 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Integer overflow in the JavaScript: Standard Library component.CVE-2026-2762 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Use-after-free in the JavaScript: GC component.CVE-2026-2758 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 23, 2026Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in tCVE-2026-25648 · Other software · traccar · reported by GitHubHigh 8.7
Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.
Product
traccar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Feb 21, 2026Isso is a lightweight commenting server written in Python and JavaScript.CVE-2026-27469 · Other software · isso-comments · reported by GitHubMedium 6.1
Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144, there is a stored Cross-Site Scripting (XSS) vulnerability affecting the website and author comment fields. The website field was HTML-escaped using quote=False, which left single and double quotes unescaped. Since the frontend inserts the website value directly into a single-quoted href attribute via string concatenation, a single quote in the URL breaks out of the attribute context, allowing injection of arbitrary event handlers (e.g. onmouseover, onclick). The same escaping is missing entirely from the user-facing comment edit endpoint (PUT /id/) and the moderation edit endpoint (POST /id//edit/). This issue has been patched in commit 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144. To workaround, nabling comment moderation (moderation = enabled = true in isso.cfg) prevents unauthenticated users from publishing comments, raising the bar for exploitation, but it does not fully mitigate the issue since a moderator activating a malicious comment would still expose visitors.
Product
isso
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.python.org github.com
Feb 21, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27193 · Other software · feathersjs · reported by GitHubHigh 8.2
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, all HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, then the session is persisted using cookie-session, which base64-encodes the data. While the cookie is signed to prevent tampering, the contents are readable by anyone by simply decoding the base64 value. Under specific deployment configurations (e.g., behind reverse proxies or API gateways), this can lead to exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses. This issue has been fixed in version 5.0.40.
Product
feathers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27192 · Other software · feathersjs · reported by GitHubHigh 7.6
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In versions 5.0.39 and below, origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.The getAllowedOrigin() function checks if the Referer header starts with any allowed origin, and this comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover. This issue has bee fixed in version 5.0.40.
Product
feathers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript.CVE-2026-27191 · Other software · feathersjs · reported by GitHubHigh 7.4
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them. The application constructs the final redirect URL by concatenating the base origin with the user-supplied redirect parameter. This is exploitable when the origins array is configured and origin values do not end with /. An attacker can supply @attacker.com as the redirect value results in https://target.com@attacker.com#access_token=..., where the browser interprets attacker.com as the host, leading to full account takeover. This issue has been fixed in version 5.0.40.
Product
feathers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2026-27190 · Other software · denoland · reported by GitHubHigh 8.1
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:child_process implementation. This vulnerability is fixed in 2.6.8.
Product
deno
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 20, 2026Asynchronous Javascript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68846 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paris Holley Asynchronous Javascript asynchronous-javascript allows Reflected XSS.This issue affects Asynchronous Javascript: from n/a through <= 1.3.5.
Product
Asynchronous Javascript
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Asynchronous Javascript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's CVE-2025-67438 · Other software · Sync-in · reported by MITREMedium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.
Product
Sync-in Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Feb 19, 2026minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.CVE-2026-26996 · Other software · isaacs · reported by GitHubHigh 8.7
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Product
minimatch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Fabric.js is a Javascript HTML5 canvas library.CVE-2026-27013 · Other software · fabricjs · reported by GitHubHigh 7.6
Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values that are interpolated into SVG attribute markup. When attacker-controlled JSON is loaded via `loadFromJSON()` and later exported via `toSVG()`, the unescaped values break out of XML attributes and inject arbitrary SVG elements including event handlers. Any application that accepts user-supplied JSON (via `loadFromJSON()`, collaborative sharing, import features, CMS plugins) and renders the `toSVG()` output in a browser context (SVG preview, export download rendered in-page, email template, embed) is vulnerable to stored XSS. An attacker can execute arbitrary JavaScript in the victim's browser session. Version 7.2.0 contains a fix.
Product
fabric.js
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25940 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize user input before passing it to the vulnerable API members.
Product
jsPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25755 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
Product
jsPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-25535 · Other software · parallax · reported by GitHubHigh 8.7
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. The vulnerability has been fixed in jsPDF 4.2.0. As a workaround, sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
Product
jsPDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 19, 2026Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victCVE-2026-2736 · Other software · Alkacon · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions while impersonating the user.
Product
OpenCms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Feb 12, 2026Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser.CVE-2025-41117 · Other software · Grafana · reported by security@grafana.comMedium 6.8
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
Product
grafana/grafana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record grafana.com
Feb 10, 2026User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted CVE-2026-1571 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 5.3
User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.
Product
Archer C60 v3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tp-link.com tp-link.com
Feb 10, 2026AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes tCVE-2026-2099 · Other software · Flowring · reported by twcert@cert.org.twMedium 5.1
AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.
Product
AgentFlow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Feb 10, 2026AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript coCVE-2026-2098 · Other software · Flowring · reported by twcert@cert.org.twMedium 5.1
AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Product
AgentFlow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Feb 9, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25881 · Other software · nyariv · reported by GitHubCritical 9
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31.
Product
SandboxJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026Enclave is a secure JavaScript sandbox designed for safe AI agent code execution.CVE-2026-25533 · Other software · agentfront · reported by GitHubMedium 6.4
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.
Product
enclave
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25641 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.
Product
SandboxJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2026SandboxJS is a JavaScript sandboxing library.CVE-2026-25587 · Other software · nyariv · reported by GitHubCritical 10
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, as Map is in SAFE_PROTOYPES, it's prototype can be obtained via Map.prototype. By overwriting Map.prototype.has the sandbox can be escaped. This vulnerability is fixed in 0.8.29.
Product
SandboxJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.