https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:44:12.006783+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2019-8331 CVE-2019-8331 2026-10-05T19:44:12.040871+00:00

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

 https://cve.radiocsirt.org/vuln/ghsa-9v3m-8fp8-mj99 GHSA-9v3m-8fp8-mj99 — Bootstrap Vulnerable to Cross-Site Scripting 2026-10-05T19:44:12.040936+00:00

Affected: RubyGems: bootstrap, RubyGems: bootstrap-sass, NuGet: Bootstrap.Less, NuGet: bootstrap, NuGet: bootstrap.sass, npm: bootstrap, npm: bootstrap-sass, RubyGems: twitter-bootstrap-rails, Maven: org.webjars:bootstrap, Packagist: twbs/bootstrap

Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

## Recommendation

For `bootstrap` 4.x upgrade to 4.3.1 or later. For `bootstrap` 3.x upgrade to 3.4.1 or later.