https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:07:29.650822+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-234423 EUVD-2026-234423 2026-10-03T04:07:29.763428+00:00 EUVD-2026-234423 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23647 fkie_cve-2022-23647 2026-10-03T04:07:29.763466+00:00

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

 https://cve.radiocsirt.org/vuln/ghsa-3949-f494-cm99 GHSA-3949-f494-cm99 — Cross-site Scripting in Prism 2026-10-03T04:07:29.763503+00:00

Affected: npm: prismjs

### Impact Prism's [Command line plugin](https://prismjs.com/plugins/command-line/) can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

### Patches This bug has been fixed in v1.27.0.

### Workarounds Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

### References - https://github.com/PrismJS/prism/pull/3341

 https://cve.radiocsirt.org/vuln/gsd-2022-23647 gsd-2022-23647 2026-10-03T04:07:29.763535+00:00 gsd-2022-23647 https://cve.radiocsirt.org/vuln/rhsa-2022:6835 RHSA-2022:6835 — Red Hat Security Advisory: Service Registry (container images) release and security update [2.3.0.GA] 2026-10-03T04:07:29.763548+00:00

protobuf-java: potential DoS in the parsing procedure for binary data netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way cron-utils: template Injection leading to unauthenticated Remote Code Execution node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes prismjs: improperly escaped output allows a XSS node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson snakeyaml: Denial of Service due to missing nested depth limitation for collections terser: insecure use of regular expressions leads to ReDoS postgresql-jdbc: Arbitrary File Write Vulnerability moment: inefficient parsing algorithm resulting in DoS graphql-java: DoS by malicious query

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23647 UBUNTU-CVE-2022-23647 2026-10-03T04:07:29.763639+00:00

Affected: Ubuntu:20.04:LTS: node-prismjs, Ubuntu:22.04:LTS: node-prismjs

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0554 WID-SEC-W-2023-0554 — IBM Maximo Asset Management: Schwachstelle ermöglicht Cross-Site Scripting 2026-10-03T04:07:29.763669+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Maximo Asset Management ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.