https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T14:28:25.328586+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2019-11358 CVE-2019-11358 2026-10-17T14:28:25.353807+00:00

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

 https://cve.radiocsirt.org/vuln/ghsa-6c3j-c64m-qhgq GHSA-6c3j-c64m-qhgq — XSS in jQuery as used in Drupal, Backdrop CMS, and other products 2026-10-17T14:28:25.353877+00:00

Affected: npm: jquery, RubyGems: jquery-rails, NuGet: jQuery, PyPI: django, Maven: org.webjars.npm:jquery, Packagist: maximebf/debugbar

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.