Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: AmauriC tarteaucitron.js 1.37.0 Clear all filters
TI-2026-75500 CVE-2026-111714 · GHSA-h33v-xq5w-v2mw

Regular expression denial of service in tarteaucitron.js cookie purge

Priority LOW 11

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00218 Published 2026-10-16 Fixed in 1.37.0 CWE-1333
TI-2026-75499 CVE-2026-111713 · GHSA-rfp9-xrhw-w637

Cross-site scripting in tarteaucitron.js via data-url attribute

Priority LOW 22

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00171 Published 2026-10-16 Fixed in 1.37.0 CWE-79