CVE-2026-73492

Loofah (Ruby, Nokogiri-based) versions 2.25.0–2.25.2 expose a vulnerability in Loofah::HTML5::Scrub.allowed_uri?, where javascript: or vbscript: URIs split by semicolon-less numeric character references (e.g., &#58, &#9, &#10, &#13) are not rejected. CGI.unescapeHTML leaves these references encod...

Fedora 13 : ikiwiki-3.20100815.7-1.fc13 (2011-5173)

Update to upstream version 3.20100815.7. Security fixes : - Possible JavaScript insertion via insufficient htmlscrubbing of alternate stylesheets. CVE-2011-1401 - JavaScript insertion via insufficient checking in comments. CVE-2011-0428 - JavaScript insertion via insufficient htmlscrubbing of...