CIVI-SA-2024-01: View Contact XSS
Within the "View Contact" screen and its sub-pages, there were multiple cross-site scripting vulnerabilities.
Within the "View Contact" screen and its sub-pages, there were multiple cross-site scripting vulnerabilities.

What’s this DocBot all about? Well, in short, it’s an AI-based bot that puts the end user, developer and system administrator documentation into a CiviCRM extension that allows fast, efficient Q&A style searches. Basically, it puts the entire CiviCRM documentation at your fingertips, providing answers and how-to style guidance in-app.
Don’t worry… the docs are NOT going away! In fact, they are as important as ever!
It’s been a few months since Mathieu reworked version 1 of the contributor listing using SearchKit. You can see it in action at https://civicrm.org/civicrm/contributors
Let me start by saying that it isn’t perfect, meaning that it doesn’t capture every contribution from every corner of the CiviVerse, nor will it display past contributors that are now inactive (at least not without them following the process detailed below).

CiviCRM includes the Smarty v2 templating engine. Templates are defined by core code, by third-party extensions, and by configurable content. The upstream smarty.net project has stopped publishing security backports for Smarty v2, so civicrm.org will do so (until a migration to a newer Smarty is complete).
As part of this, the CiviCRM security team has done a detailed audit to compare recent issues from v2/v3/v4.
CiviEvent included multiple screens with a vulnerability to cross-site scripting (XSS).