https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T15:49:34.196858+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292323 EUVD-2026-292323 2026-10-07T15:49:34.246345+00:00 EUVD-2026-292323 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27937 fkie_cve-2026-27937 2026-10-07T15:49:34.246386+00:00

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

 https://cve.radiocsirt.org/vuln/ghsa-jj38-h5w5-mvpf GHSA-jj38-h5w5-mvpf — October CMS: Reflected XSS via DataTable Form Widget 2026-10-07T15:49:34.246421+00:00

Affected: Packagist: october/system

A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.

### Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to visit a crafted URL - No direct access is gained without social engineering

### Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.

### Workarounds - Use a non-default backend URL prefix (recommended as standard practice) - Implement a Content Security Policy (CSP) for backend pages