https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 14:26:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-34716 <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo YPTSocket plugin&#39;s caller feature renders incoming call notifications using the jQuery Toast Plugin, passing the caller&#39;s display name directly as the heading parameter. The toast plugin constructs the heading as raw HTML (&#39;&lt;h2&gt;&#39; + heading + &#39;&lt;/h2&gt;&#39;) and inserts it into the DOM via jQuery&#39;s .html() method, which parses and executes any embedded HTML or script content. An attacker can set their display name to an XSS payload and trigger code execution on any online user&#39;s browser simply by initiating a call - no victim interaction is required beyond being connected to the WebSocket. At time of publication, there are no publicly available patches.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo YPTSocket plugin&#39;s caller feature renders incoming call notifications using the jQuery Toast Plugin, passing the caller&#39;s display name directly as the heading parameter. The toast plugin constructs the heading as raw HTML (&#39;&lt;h2&gt;&#39; + heading + &#39;&lt;/h2&gt;&#39;) and inserts it into the DOM via jQuery&#39;s .html() method, which parses and executes any embedded HTML or script content. An attacker can set their display name to an XSS payload and trigger code execution on any online user&#39;s browser simply by initiating a call - no victim interaction is required beyond being connected to the WebSocket. At time of publication, there are no publicly available patches.</p> https://cve.radiocsirt.org/vuln/cve-2026-34716