https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T06:03:35.518671+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273755 EUVD-2026-273755 2026-10-10T06:03:35.563935+00:00 EUVD-2026-273755 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26861 fkie_cve-2026-26861 2026-10-10T06:03:35.563972+00:00

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain

 https://cve.radiocsirt.org/vuln/ghsa-j5mf-6rh3-rhgg GHSA-j5mf-6rh3-rhgg — CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function 2026-10-10T06:03:35.564006+00:00

Affected: npm: clevertap-web-sdk

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain.