QGIS QGIS

• CVE-2026-104140 Medium 6.1 QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values 0.2%
• CVE-2026-24480 High 8.7 QGIS had validated RCE and Repository Takeover via GitHub Actions 0.5%