775 matches found
CVE-2026-73427
Trix (rich-text editor) is vulnerable before version 2.1.18 to a cross-site scripting flaw via a crafted application/x-trix-document JSON payload dropped into an editor using the fallback Level0InputController (e.g., embedded WebView without Input Events Level 2 support). The StringPiece.fromJSON...
CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...
CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...
CLSA-2026-1786539981 TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1...
PT-2026-71341
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...
GHSA-55Q2-FJHQ-7XH7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Summary During INPLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize returns, even though the returned root is clean and the image remains disconnect...
Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)
Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...
Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)
Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...
Security Bulletin: Cyber Fraud includes components with multiple known vulnerabilities
Summary Cyber Fraud includes components with known vulnerabilities. These have been addressed in the update. Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and...
SUSE CVE-2026-65900
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...
CLSA-2026-1785554485 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.6...
CLSA-2026-1784943203 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.7...
CLSA-2026-1784943304 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.0-tuxcare.4...
CLSA-2026-1784769607 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.0.3-tuxcare.4...
CLSA-2026-1784856439 TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.4...
CLSA-2026-1784769611 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.5...
CLSA-2026-1784856216 TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.5.8-tuxcare.6...