medium2026-11-10 CVE-2026-110802-Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox GHSA-752m-7p75-49gf