Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:36:36 +0000 EUVD-2026-276305 https://cve.radiocsirt.org/vuln/euvd-2026-276305 EUVD-2026-276305 https://cve.radiocsirt.org/vuln/euvd-2026-276305 fkie_cve-2026-32732 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32732 <p>Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.</p> <p>Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML. The issue has been resolved in 0.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32732 GHSA-6ggm-pwr9-r5h2 — XSS in @leanprover/unicode-input-component https://cve.radiocsirt.org/vuln/ghsa-6ggm-pwr9-r5h2 <p><strong>Affected:</strong> npm: @leanprover/unicode-input-component</p> <p>### Impact Projects that use [@leanprover/unicode-input-component](https://www.npmjs.com/package/@leanprover/unicode-input-component) are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML.</p> <p>### Patches The issue has been resolved in 0.2.0.</p> <p>### Workarounds Replace the unicode input component with a basic HTML text field.</p> <p><strong>Affected:</strong> npm: @leanprover/unicode-input-component</p> <p>### Impact Projects that use [@leanprover/unicode-input-component](https://www.npmjs.com/package/@leanprover/unicode-input-component) are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as unescaped HTML.</p> <p>### Patches The issue has been resolved in 0.2.0.</p> <p>### Workarounds Replace the unicode input component with a basic HTML text field.</p> https://cve.radiocsirt.org/vuln/ghsa-6ggm-pwr9-r5h2