PatchTheCVE: naverhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-1513: billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization durhttps://patchthecve.com/cve/CVE-2026-1513.htmlhttps://patchthecve.com/cve/CVE-2026-1513.htmlWed, 17 Jun 2026 10:15:58 +0000MEDIUM 6.1: billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.CVE-2026-23769: lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanithttps://patchthecve.com/cve/CVE-2026-23769.htmlhttps://patchthecve.com/cve/CVE-2026-23769.htmlWed, 17 Jun 2026 10:22:05 +0000MEDIUM 6.1: lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.CVE-2026-23768: lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLshttps://patchthecve.com/cve/CVE-2026-23768.htmlhttps://patchthecve.com/cve/CVE-2026-23768.htmlWed, 17 Jun 2026 10:22:04 +0000MEDIUM 6.1: lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.