Vulnerabilities

TI-2026-02866 CVE-2026-3323 · GHSA-rjqm-m642-mm46

VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices

LOW 39

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00405 Published 2026-04-28 No fix listed CWE-306

TI-2025-41032 CVE-2025-66648 · GHSA-m9rg-mr6g-75gm

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

LOW 37

vega-functions provides function implementations for the Vega expression language.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00226 Published 2026-01-05 Fixed in 6.1.1 CWE-79

TI-2025-40262 CVE-2025-65110 · GHSA-829q-m3qg-ph8r

Cross-site scripting in vega

HIGH 75

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00504 Published 2026-01-05 Fixed in 5.6.3, 6.1.2 CWE-79

TI-2025-37279 CVE-2025-59840 · GHSA-7f2v-3qq3-vvjf

Cross-site scripting in vega

HIGH 68

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00424 Published 2025-11-13 Partial fix · 6.2.0, 6.1.0 +3 CWE-79

TI-2025-20572 CVE-2025-27793 · GHSA-963h-3v39-3pqf

Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

LOW 25

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00517 Published 2025-03-27 Fixed in 5.32.0, 5.17.0 CWE-79

TI-2025-19556 CVE-2025-26619 · GHSA-rcw3-wmx7-cphr

Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`

MEDIUM 63

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00354 Published 2025-03-27 Fixed in 5.31.0, 5.16.0 CWE-79

TI-2025-18958 CVE-2025-25304 · GHSA-mp7w-mhcv-673j

Vega allows Cross-site Scripting via the vlSelectionTuples function

HIGH 70

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00651 Published 2025-02-14 Fixed in 5.26.0, 5.4.2 CWE-79

TI-2023-11633 CVE-2023-26486 · GHSA-4vq7-882g-wcg4

Vega `scale` expression function cross site scripting

LOW 36

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00775 Published 2023-03-03 Partial fix · 5.13.1, 5.23.0 CWE-79

TI-2023-11634 CVE-2023-26487 · GHSA-w5m3-xh75-mp55

Vega has cross-site scripting vulnerability in `lassoAppend` function

LOW 36

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argum…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00806 Published 2023-03-03 Partial fix · 5.23.0, 5.13.1 CWE-79

TI-2020-16117 CVE-2020-26296 · GHSA-r2qc-w64x-6j54

Cross-site scripting in vega

MEDIUM 41

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.01713 Published 2020-12-30 Partial fix · 5.17.3 CWE-79

Vulnerabilities

Filters