https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:35:51.618617+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-34721 cnvd-2019-34721 2026-10-05T15:35:51.640358+00:00 cnvd-2019-34721 https://cve.radiocsirt.org/vuln/euvd-2026-80357 EUVD-2026-80357 2026-10-05T15:35:51.640396+00:00 EUVD-2026-80357 https://cve.radiocsirt.org/vuln/fkie_cve-2017-18635 fkie_cve-2017-18635 2026-10-05T15:35:51.640409+00:00

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

 https://cve.radiocsirt.org/vuln/ghsa-49rv-g7w5-m8xx GHSA-49rv-g7w5-m8xx — Cross-Site Scripting in @novnc/novnc 2026-10-05T15:35:51.640439+00:00

Affected: npm: @novnc/novnc

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`.

## Recommendation

Upgrade to version 0.6.2 or later.

 https://cve.radiocsirt.org/vuln/gsd-2017-18635 gsd-2017-18635 2026-10-05T15:35:51.640465+00:00 gsd-2017-18635 https://cve.radiocsirt.org/vuln/rhsa-2020:0754 RHSA-2020:0754 — Red Hat Security Advisory: novnc security update 2026-10-05T15:35:51.640476+00:00

novnc: XSS vulnerability via the messages propagated to the status field

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-18635 UBUNTU-CVE-2017-18635 2026-10-05T15:35:51.640493+00:00

Affected: Ubuntu:16.04:LTS: novnc, Ubuntu:18.04:LTS: novnc

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.