java-html-sanitizer

OWASP Java HTML Sanitizer أداة تعقيم HTML سريعة وسهلة التهيئة مكتوبة بلغة Java تتيح لك تضمين HTML من كتابة أطراف ثالثة في تطبيق الويب الخاص بك مع الحماية من هجمات XSS. الاعتماد الحالي هو على JSR 305. أما بقية ملفات jar فهي مطلوبة فقط لمجموعة الاختبارات. اعتماد JSR 305 هو اعتماد فقط في زمن الترجمة...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2025-25296

إثبات المفهوم POC لثغرة CVE-2025-25296 الوصف يوضح هذا المشروع إثباتًا للمفهوم POC لثغرة CVE-2025-25296 التي تؤثر على Label Studio، وهي أداة مفتوحة المصدر لوضع العلامات على البيانات. تكمن الثغرة في نقطة النهاية /projects/upload-example، التي تفشل في تنظيف محتوى HTML المقدم من المستخدم في طلبات GET...

CVE-2026-56128

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56127

pfSense Plus before 26.07 and pfSense CE before 2.9.0 are affected by a stored XSS in /firewall_rules_edit.php. An authenticated user holding the Firewall: Rules: Edit privilege can inject arbitrary JavaScript via the descr parameter. The rule description is persisted in the pfSense XML configura...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy مكتبة لإجراء تنظيف سريع وقابل للتهيئة لـ HTML الوارد من مصادر غير موثوقة. تدعم Java 7+. يمكن التعبير عن ذلك بطريقة أخرى: إنها API تساعدك على التأكد من أن العملاء لا يوفّرون حمولة شيفرة خبيثة في HTML الذي يرسلونه لملفاتهم الشخصية أو تعليقاتهم وما إلى ذلك، والذي يُحفظ على الخادم. يُقصد...

CVE-2026-22849

CVE-2026-22849 : Saleor ne dispose pas d'un assainissement HTML adéquat dans les champs de texte enrichi Aperçu...

CVE-2024-42009

CVE-2024-42009 – Roundcube संग्रहीत XSS Docker PoC 📌 अवलोकन यह रिपॉजिटरी CVE-2024-42009 के लिए एक कार्यशील प्रूफ-ऑफ-कॉन्सेप्ट PoC प्रदर्शित करती है, जो Roundcube वेबमेल में एक संग्रहीत क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता है। यह भेद्यता अनुचित HTML स्वच्छता और उसके बाद असुरक्षित विशेषता...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy अविश्वसनीय स्रोतों से प्राप्त HTML के तीव्र और कॉन्फ़िगरेबल शुद्धिकरण cleansing करने के लिए एक लाइब्रेरी। इसे दूसरे तरीके से कहें तो: यह एक API है जो यह सुनिश्चित करने में मदद करती है कि क्लाइंट अपने प्रोफ़ाइल, टिप्पणियों आदि के लिए प्रदान किए गए HTML में दुर्भावनापूर्ण कार्गो कोड सर्वर ...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

PT-2026-82372

Name of the Vulnerable Software and Affected Versions Drupal Monster Menus versions 0.0.0 through 9.5.3 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently sanitize HTML code within the page name when it is displayed in the built-in tree browser. This allow...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, certain configurations of Rails::Html::Sanitizer could potentially introduce XSS vulnerabilities. An attacker could inject content if the application developer overrides the sanitizer’...

CVE-2026-7808

justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...

CVE-2026-61824 Defuddle: XSS via unescaped attribute interpolation in site extractors

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

EUVD-2026-62932

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-76367

In Splunk SOAR versions below 8.6.0, the Notes feature fails to sanitize content when a note's format changes, allowing an "Incident Commander" role user to store JavaScript that executes in another user's browser upon viewing. This stored XSS requires phishing the target to initiate a browser re...

BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...