https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:37:30.177271+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-51464 CVE-2025-51464 2026-10-03T23:37:30.178929+00:00

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().

 https://cve.radiocsirt.org/vuln/ghsa-gmvv-rj92-9w35 GHSA-gmvv-rj92-9w35 — Aim vulnerable to Cross-site Scripting 2026-10-03T23:37:30.178979+00:00

Affected: PyPI: aim

Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().