Visit Website →

Recent Items

CVE-2026-40472 — Hackage package metadata stored XSS vulnerability

Affected: hackage-server

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.

Updated on 2026-10-06T10:17:32.026963+00:00