https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T13:42:22.762365+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-14394 bdu:2025-14394 2026-10-09T13:42:22.834730+00:00 bdu:2025-14394 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1001 certfr-2025-avi-1001 — De multiples vulnérabilités ont été découvertes dans Elastic Kibana. Elles permettent à un attaquant de provoquer une f… 2026-10-09T13:42:22.834778+00:00 certfr-2025-avi-1001 https://cve.radiocsirt.org/vuln/euvd-2026-260851 EUVD-2026-260851 2026-10-09T13:42:22.834800+00:00 EUVD-2026-260851 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59840 fkie_cve-2025-59840 2026-10-09T13:42:22.834836+00:00

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.

 https://cve.radiocsirt.org/vuln/ghsa-7f2v-3qq3-vvjf GHSA-7f2v-3qq3-vvjf — Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global vari… 2026-10-09T13:42:22.834952+00:00

Affected: npm: vega, npm: vega-expression, npm: vega-interpreter

## Impact

Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" [expressionInterpreter](https://vega.github.io/vega/usage/interpreter/) is used.

1. Use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega [Editor](https://github.com/vega/editor) to the global `window` 2. Allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code)

## Patches

- If using latest Vega line (6.x) - `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode) - If using Vega in a non-ESM environment - ( `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode)

## Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading_

- Do not attach `vega` View instances to global variables, as Vega editor used to do [here](https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/components/renderer/renderer.tsx#L239) - Do not attach `vega` to the global window as the editor used to do [here](https://github.com/vega/editor/blob/e102355589d23cdd0dbfd607a2cc5f9c5b7a4c55/src/index.tsx#L14-L16)

These practices of attaching the vega library and View instances may be convenient for debugging, but should _not_ be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.

### POC Summary

Vega offers the eva…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-59840 UBUNTU-CVE-2025-59840 2026-10-09T13:42:22.835154+00:00

Affected: Ubuntu:24.04:LTS: vega.js, Ubuntu:25.10: vega.js, Ubuntu:26.04:LTS: vega.js

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter` `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2576 WID-SEC-W-2025-2576 — Kibana: Mehrere Schwachstellen 2026-10-09T13:42:22.835248+00:00

Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.