Threats affecting pkg:github/certcc/cveClient

CVE-2026-35467 is a high-severity vulnerability in the CERT/CC cveClient/encrypt-storage.js component where API keys stored in the temporary browser client are insufficiently protected. The encryption credentials are not properly marked as protected, which could allow extraction through JavaScript console access or other errors. This vulnerability has a CVSS score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-35466 is a cross-site scripting (XSS) vulnerability in the cveClient/cveInterface.js component of CERT/CC. The vulnerability arises because the script improperly neutralizes input during web page generation, allowing injected HTML from CVE API services to be passed to the display. This can lead to partial compromise of confidentiality and integrity via reflected XSS. The vulnerability has a CVSS score of 6.1 (medium severity). No patch or official remediation information is currently available.