CVE-2026-26352 Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter

Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPNIP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes whe...

CVE-2026-26352

Affected product/versions: Smoothwall Express

CVE-2026-26352: Improper Neutralization of Input During Web Page Generation

Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPNIP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes whe...

PT-2026-29062

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions prior to 3.1 Update 13 Description Smoothwall Express is affected by a reflected cross-site scripting issue. The /redirect.cgi endpoint does not properly sanitize the url parameter, allowing attackers to inject...

Smoothwall Express 跨站脚本漏洞

Smoothwall Express is an open-source firewall operating system based on GNU/Linux, developed by Smoothwall. Versions of Smoothwall Express prior to 3.1 Update 13 had a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of URL parameters, which could lead to...

Smoothwall Express 跨站脚本漏洞

Smoothwall Express is an open-source firewall operating system based on GNU/Linux, developed by Smoothwall. Versions of Smoothwall Express prior to 3.1 Update 13 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of VPNIP parameters, and could lead t...

CVE-2026-27508: Improper Neutralization of Input During Web Page Generation

Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browse...

CVE-2026-33979

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

CVE-2026-33979

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

CVE-2026-33979

CVE-2026-33979 affects the Express XSS Sanitizer middleware (Express 4.x/5.x). The root cause is that, in versions prior to 2.0.2, explicitly provided empty configurations for allowedTags or allowedAttributes are ignored, causing a fallback to sanitize-html’s permissive defaults. This leads to a ...

CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

CVE-2026-33979

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Summary The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery SSRF. An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. Affected packages Only applicatio...

@omchat/common (>=1.0.0, <=1.0.4), @tverse/ui (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-33979 via express-xss-sanitizer (1.2.1)

express-xss-sanitizer NPM version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on express-xss-sanitizer and may be impacted: - @omchat/common =1.0.0, =0.1.0, =1.2.0, =1.0.0, =1.14.31, =1.15.2 Source cves: CVE-2026-33979 Source advisory:...

Permissive List of Allowed Inputs

Overview express-xss-sanitizer is an Express 4.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. Affected versions of this package are vulnerable to Permissive List of Allowed Inputs through the...

GHSA-3843-RR4G-M8JQ Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Description A vulnerability has been identified in express-xss-sanitizer , , , etc. and attributes e.g., href on . This behavior violates the expected API contract and may lead to security issues such as content injection or XSS, depending on how the sanitized output is used. Impact Developers...

Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Description A vulnerability has been identified in express-xss-sanitizer , , , etc. and attributes e.g., href on . This behavior violates the expected API contract and may lead to security issues such as content injection or XSS, depending on how the sanitized output is used. Impact Developers...

Express XSS Sanitizer 安全漏洞

Express XSS Sanitizer is a tool developed by AhmedAdelFahim to clean user input data found in req.body, req.query, req.headers, and req.params to prevent Cross-Site Scripting XSS attacks. Versions of Express XSS Sanitizer prior to version 2.0.2 contained a security vulnerability. This vulnerabili...