CVE-2026-120988: billboard.js before 4.1.3 allows an… – CVSS 6.1 · Watchpost