https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:36:50 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 https://cve.radiocsirt.org/vuln/euvd-2026-321450 EUVD-2026-321450 https://cve.radiocsirt.org/vuln/euvd-2026-321450 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45249 <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45249 https://cve.radiocsirt.org/vuln/ghsa-fgmj-fm8m-jvvx <p><strong>Affected:</strong> npm: echarts</p> <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> <p><strong>Affected:</strong> npm: echarts</p> <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-fgmj-fm8m-jvvx