PatchTheCVE: bootstraphttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-8331: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attrhttps://patchthecve.com/cve/CVE-2019-8331.htmlhttps://patchthecve.com/cve/CVE-2019-8331.htmlWed, 17 Jun 2026 02:41:51 +0000MEDIUM 6.1: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.CVE-2018-20677: In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.https://patchthecve.com/cve/CVE-2018-20677.htmlhttps://patchthecve.com/cve/CVE-2018-20677.htmlWed, 17 Jun 2026 01:53:18 +0000MEDIUM 6.1: In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.CVE-2018-20676: In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.https://patchthecve.com/cve/CVE-2018-20676.htmlhttps://patchthecve.com/cve/CVE-2018-20676.htmlWed, 17 Jun 2026 01:53:18 +0000MEDIUM 6.1: In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.CVE-2016-10735: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, https://patchthecve.com/cve/CVE-2016-10735.htmlhttps://patchthecve.com/cve/CVE-2016-10735.htmlWed, 17 Jun 2026 00:40:15 +0000MEDIUM 6.1: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.CVE-2018-14042: In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.https://patchthecve.com/cve/CVE-2018-14042.htmlhttps://patchthecve.com/cve/CVE-2018-14042.htmlWed, 17 Jun 2026 01:40:31 +0000MEDIUM 6.1: In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.CVE-2018-14041: In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.https://patchthecve.com/cve/CVE-2018-14041.htmlhttps://patchthecve.com/cve/CVE-2018-14041.htmlWed, 17 Jun 2026 01:40:31 +0000MEDIUM 6.1: In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.CVE-2018-14040: In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.https://patchthecve.com/cve/CVE-2018-14040.htmlhttps://patchthecve.com/cve/CVE-2018-14040.htmlWed, 17 Jun 2026 01:40:31 +0000MEDIUM 6.1: In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.