Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
Critical in the last 24 hours
2
1602 in 30 days
Newly known exploited
0
In the last 24 hours, CISA KEV and vendor reports
New in the last 24 hours
160-73% vs 7-day avg of 598
2 critical, 46 high, 62 medium, 30 low
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.1 | CVE-2026-94402 |
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting
IBMIBM @carbon/charts, IBM @carbon/charts-react, IBM @carbon/charts-angular, IBM @carbon/charts-vue, IBM @carbon/charts-svelte
|
NVD | |||
|
CVE-2026-94402IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting
From the advisoryIBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N AffectsIBMIBM @carbon/chartsIBM @carbon/charts-reactIBM @carbon/charts-angularIBM @carbon/charts-vueIBM @carbon/charts-svelte
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
Showing 1 of 1Press / to search