https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:38:07 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06490 bdu:2026-06490 https://cve.radiocsirt.org/vuln/bdu:2026-06490 https://cve.radiocsirt.org/vuln/euvd-2026-290926 EUVD-2026-290926 https://cve.radiocsirt.org/vuln/euvd-2026-290926 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1116 <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1116 https://cve.radiocsirt.org/vuln/ghsa-w676-j9x4-3hq2 <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-w676-j9x4-3hq2 https://cve.radiocsirt.org/vuln/pysec-2026-2200 <p><strong>Affected:</strong> PyPI: lollms</p> <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of sanitization or HTML encoding of the `content` field when deserializing user-provided data. This allows an attacker to inject malicious HTML or JavaScript payloads, which can be executed in the context of another user&#39;s browser. Exploitation of this vulnerability can lead to account takeover, session hijacking, or wormable attacks.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2200