CVE-2026-15697

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94 CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-156986.3A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update A CVE-2026-156996.3A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.j CVE-2026-15706.4The Simple Bible Verse via Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `verse` shortcode in CVE-2026-157004.7A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.c CVE-2026-157019.8A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /fo CVE-2026-157026.3A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/conf CVE-2026-157037.3A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file CVE-2026-157049.8In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused CVE-2026-157069.8Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Manage CVE-2026-157097.5A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (infl CVE-2026-15716.1User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript exec CVE-2026-157106.8An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R14