https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:26:27.385707+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-drupal-2021-41183 BIT-drupal-2021-41183 — XSS in `*Text` options of the Datepicker widget 2026-10-02T14:26:27.547018+00:00

Affected: Bitnami: drupal

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-058 certfr-2022-avi-058 — De multiples vulnérabilités ont été découvertes dans Drupal core. Elles permettent à un attaquant de provoquer une inje… 2026-10-02T14:26:27.547072+00:00 certfr-2022-avi-058 https://cve.radiocsirt.org/vuln/cleanstart-2024-nd69835 CLEANSTART-2024-ND69835 — jQuery-UI is the official jQuery user interface library 2026-10-02T14:26:27.547092+00:00

Affected: CleanStart: drupal7

Security vulnerability affects the drupal7 package. jQuery-UI is the official jQuery user interface library.

 https://cve.radiocsirt.org/vuln/euvd-2026-215980 EUVD-2026-215980 2026-10-02T14:26:27.547112+00:00 EUVD-2026-215980 https://cve.radiocsirt.org/vuln/fkie_cve-2021-41183 fkie_cve-2021-41183 2026-10-02T14:26:27.547124+00:00

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

 https://cve.radiocsirt.org/vuln/ghsa-j7qv-pgf6-hvh4 GHSA-j7qv-pgf6-hvh4 — XSS in `*Text` options of the Datepicker widget in jquery-ui 2026-10-02T14:26:27.547146+00:00

Affected: npm: jquery-ui, Maven: org.webjars.npm:jquery-ui, RubyGems: jquery-ui-rails, NuGet: jQuery.UI.Combined

### Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); ``` will call `doEvilThing` with 6 different parameters coming from all `*Text` options.

### Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.

### Workarounds A workaround is to not accept the value of the `*Text` options from untrusted sources.

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.

 https://cve.radiocsirt.org/vuln/gsd-2021-41183 gsd-2021-41183 2026-10-02T14:26:27.547184+00:00 gsd-2021-41183 https://cve.radiocsirt.org/vuln/oesa-2022-1693 OESA-2022-1693 — python-XStatic-jquery-ui security update 2026-10-02T14:26:27.547196+00:00

Affected: openEuler:20.03-LTS-SP3: python-XStatic-jquery-ui

jquery-ui javascript library packaged for setuptools (easy_install) / pip. This package is intended to be used by **any** project that needs these files. It intentionally does **not** provide any extra code except some metadata **nor** has any extra requirements. You MAY use some minimal support code from the XStatic base package, if you like. You can find more info about the xstatic packaging way in the package `XStatic`. Security Fix(es): jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.(CVE-2021-41183)

 https://cve.radiocsirt.org/vuln/rhsa-2022:4711 RHSA-2022:4711 — Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update 2026-10-02T14:26:27.547231+00:00

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-trim-off-newlines: ReDoS via string processing nodejs-normalize-url: ReDoS for data URLs jquery-ui: XSS in the altField option of the datepicker widget jquery-ui: XSS in *Text options of the datepicker widget jquery-ui: XSS in the 'of' option of the .position() util

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-41183 UBUNTU-CVE-2021-41183 2026-10-02T14:26:27.547259+00:00

Affected: Ubuntu:Pro:14.04:LTS: jqueryui, Ubuntu:Pro:16.04:LTS: jqueryui, Ubuntu:Pro:18.04:LTS: jqueryui, Ubuntu:20.04:LTS: jqueryui

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

 https://cve.radiocsirt.org/vuln/vde-2022-019 VDE-2022-019 — Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components 2026-10-02T14:26:27.547282+00:00

For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1729 WID-SEC-W-2022-1729 — jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting 2026-10-02T14:26:27.547300+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.