https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T02:26:58.827210+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-91942 CVE-2026-91942 — crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML 2026-10-08T02:26:58.846603+00:00

Affected: unclecode crawl4ai

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.