TI-2025-40262 CVE-2025-65110 · GHSA-829q-m3qg-ph8r
Cross-site scripting in vega
Priority HIGH 75
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
vega
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
vega records in CISA KEVNo vega vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2025-18958 CVE-2025-25304 · GHSA-mp7w-mhcv-673j
Vega allows Cross-site Scripting via the vlSelectionTuples function
Priority HIGH 70
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
TI-2025-37279 CVE-2025-59840 · GHSA-7f2v-3qq3-vvjf
Cross-site scripting in vega
Priority HIGH 68
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
TI-2025-19556 CVE-2025-26619 · GHSA-rcw3-wmx7-cphr
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`
Priority MEDIUM 63
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
TI-2020-16117 CVE-2020-26296 · GHSA-r2qc-w64x-6j54
Cross-site scripting in vega
Priority MEDIUM 41
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
TI-2026-02866 CVE-2026-3323 · GHSA-rjqm-m642-mm46
VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices
Priority LOW 39
An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.
TI-2025-41032 CVE-2025-66648 · GHSA-m9rg-mr6g-75gm
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function
Priority LOW 37
vega-functions provides function implementations for the Vega expression language.
TI-2023-11634 CVE-2023-26487 · GHSA-w5m3-xh75-mp55
Vega has cross-site scripting vulnerability in `lassoAppend` function
Priority LOW 36
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argum…
TI-2023-11633 CVE-2023-26486 · GHSA-4vq7-882g-wcg4
Vega `scale` expression function cross site scripting
Priority LOW 36
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.
TI-2025-20572 CVE-2025-27793 · GHSA-963h-3v39-3pqf
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Priority LOW 25
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.