https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:22:05 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09110 bdu:2026-09110 https://cve.radiocsirt.org/vuln/bdu:2026-09110 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-so65050 <p><strong>Affected:</strong> CleanStart: jitsucom-jitsu</p> <p>Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: jitsucom-jitsu</p> <p>Security vulnerability affects the jitsucom-jitsu package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-so65050 https://cve.radiocsirt.org/vuln/euvd-2026-318174 EUVD-2026-318174 https://cve.radiocsirt.org/vuln/euvd-2026-318174 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44580 <p>Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor&#39;s browser. This vulnerability is fixed in 15.5.16 and 16.2.5.</p> <p>Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor&#39;s browser. This vulnerability is fixed in 15.5.16 and 16.2.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44580 https://cve.radiocsirt.org/vuln/ghsa-gx5p-jg67-6x7h <p><strong>Affected:</strong> npm: next</p> <p>### Impact</p> <p>Applications that use `beforeInteractive` scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor&#39;s browser.</p> <p>### Fix</p> <p>We now HTML-escape serialized `beforeInteractive` script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately, do not pass untrusted data into `beforeInteractive` scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.</p> <p><strong>Affected:</strong> npm: next</p> <p>### Impact</p> <p>Applications that use `beforeInteractive` scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor&#39;s browser.</p> <p>### Fix</p> <p>We now HTML-escape serialized `beforeInteractive` script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately, do not pass untrusted data into `beforeInteractive` scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.</p> https://cve.radiocsirt.org/vuln/ghsa-gx5p-jg67-6x7h https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1401 <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Vercel Next.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1401