https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:59:59 +0000 https://cve.radiocsirt.org/vuln/cve-2026-10032 <p><strong>Affected:</strong> Google @a2ui/web_core</p> <p>The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component&#39;s functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application&#39;s browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.</p> <p><strong>Affected:</strong> Google @a2ui/web_core</p> <p>The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component&#39;s functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application&#39;s browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.</p> https://cve.radiocsirt.org/vuln/cve-2026-10032