https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 19:09:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274077 EUVD-2026-274077 https://cve.radiocsirt.org/vuln/euvd-2026-274077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28401 <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28401 https://cve.radiocsirt.org/vuln/ghsa-wwp2-x4rj-j8rm <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS.</p> <p>### Details Rich text in `TextArea.vue` was parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.</p> <p>### Impact Stored XSS — malicious scripts execute for any user viewing the cell.</p> <p>### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS.</p> <p>### Details Rich text in `TextArea.vue` was parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.</p> <p>### Impact Stored XSS — malicious scripts execute for any user viewing the cell.</p> <p>### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).</p> https://cve.radiocsirt.org/vuln/ghsa-wwp2-x4rj-j8rm