AmauriC tarteaucitron.js

• CVE-2026-111714 Low 3.1 tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge 0.2%
• CVE-2026-111713 Medium 5.4 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch 0.2%
• CVE-2026-49977 Medium 4.3 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies 0.4%
• CVE-2026-22809 Medium 4.4 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability 0.1%
• CVE-2025-48939 Medium 4.2 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript 0.2%
• CVE-2025-31476 Medium 4.8 tarteaucitron.js allows url scheme injection via unfiltered inputs 0.4%
• CVE-2025-31475 Medium 5.5 tarteaucitron.js allows prototype pollution via custom text injection 0.4%
• CVE-2025-31138 Medium 5.5 tarteaucitron.js allows UI manipulation via unrestricted CSS injection 0.3%