Most recent entries from all

EUVD-2026-360099

2026-10-07T07:23:33.898248+00:00

EUVD-2026-360099

fkie_cve-2026-81814

2026-10-07T07:23:33.898297+00:00

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.

The fix changes:

titleEl.innerHTML = arg.event.title

to:

titleEl.textContent = arg.event.title || ''

and similarly stops using innerHTML for the static download icon.

Version impacted =>3.3.0

GHSA-pw4w-qcm7-cgq8

2026-10-07T07:23:33.898396+00:00

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.

The fix changes:

titleEl.innerHTML = arg.event.title

to:

titleEl.textContent = arg.event.title || ''

and similarly stops using innerHTML for the static download icon.

Version impacted =>3.3.0