https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:21:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292323 EUVD-2026-292323 https://cve.radiocsirt.org/vuln/euvd-2026-292323 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27937 <p>October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.</p> <p>October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27937 https://cve.radiocsirt.org/vuln/ghsa-jj38-h5w5-mvpf <p><strong>Affected:</strong> Packagist: october/system</p> <p>A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.</p> <p>### Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to visit a crafted URL - No direct access is gained without social engineering</p> <p>### Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.</p> <p>### Workarounds - Use a non-default backend URL prefix (recommended as standard practice) - Implement a Content Security Policy (CSP) for backend pages</p> <p><strong>Affected:</strong> Packagist: october/system</p> <p>A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.</p> <p>### Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to visit a crafted URL - No direct access is gained without social engineering</p> <p>### Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.</p> <p>### Workarounds - Use a non-default backend URL prefix (recommended as standard practice) - Implement a Content Security Policy (CSP) for backend pages</p> https://cve.radiocsirt.org/vuln/ghsa-jj38-h5w5-mvpf