{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.0"}],"component":"vulnogram","cve_ids":["CVE-2026-32774"],"ecosystem":"npm","epss":0.00282,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vggc-6pg2-xvp9","id":"tcs_01M5KGBTXBC488XVDXTMV3QQ11","modified_at":"2026-04-02T13:41:06.065726624Z","published_at":"2026-03-16T15:30:43Z","references":["https://osv.dev/vulnerability/GHSA-vggc-6pg2-xvp9","https://github.com/Vulnogram/Vulnogram/security/advisories/GHSA-pg4p-2985-gvxr","https://nvd.nist.gov/vuln/detail/CVE-2026-32774","https://github.com/Vulnogram/Vulnogram/commit/2f0e21b113c58124084c7b74c9768fc241126a05","https://github.com/Vulnogram/Vulnogram","https://www.vulncheck.com/advisories/vulnogram-stored-cross-site-scripting-via-comment-hypertext"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-vggc-6pg2-xvp9","url":"https://osv.dev/vulnerability/GHSA-vggc-6pg2-xvp9"}],"summary":"Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling"}