https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 15:36:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-56264 <p><strong>Affected:</strong> Crawl4AI</p> <p>Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server&#39;s /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server&#39;s browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser&#39;s relaxed security settings, perform server-side request forgery against internal services.</p> <p><strong>Affected:</strong> Crawl4AI</p> <p>Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server&#39;s /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server&#39;s browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser&#39;s relaxed security settings, perform server-side request forgery against internal services.</p> https://cve.radiocsirt.org/vuln/cve-2026-56264 https://cve.radiocsirt.org/vuln/ghsa-g2pv-76hm-j4x9 <p>Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server&#39;s /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server&#39;s browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser&#39;s relaxed security settings, perform server-side request forgery against internal services.</p> <p>Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server&#39;s /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server&#39;s browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser&#39;s relaxed security settings, perform server-side request forgery against internal services.</p> https://cve.radiocsirt.org/vuln/ghsa-g2pv-76hm-j4x9