https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T00:17:38.025120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-164015 EUVD-2026-164015 2026-10-03T00:17:38.027965+00:00 EUVD-2026-164015 https://cve.radiocsirt.org/vuln/fkie_cve-2010-2273 fkie_cve-2010-2273 2026-10-03T00:17:38.027996+00:00

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.

 https://cve.radiocsirt.org/vuln/ghsa-536q-8gxx-m782 GHSA-536q-8gxx-m782 — Cross-Site Scripting in dojo 2026-10-03T00:17:38.028029+00:00

Affected: npm: dojo

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.

## Recommendation

Upgrade to version 1.4.2 or later.

 https://cve.radiocsirt.org/vuln/gsd-2010-2273 gsd-2010-2273 2026-10-03T00:17:38.028058+00:00 gsd-2010-2273