CVE-2026-113583

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

EUVD-2026-104966

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-113442

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442

The TYPO3 Fluid-Form by coding.ms extension (fluid_form ) is vulnerable to Cross-Site Scripting (XSS) due to a lack of input escaping. Specifically, values provided by visitors are inserted into the HTML summary email without proper sanitization. This allows an unauthenticated attacker to inject ...

EUVD-2026-104868

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CLSA-2026-1792458250 TuxCare security update for @storybook/preset-html-webpack (1 CVE)

TuxCare rebuilt @storybook/preset-html-webpack to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

CLEANSTART-2026-PZ98316 OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS

Security vulnerability affects the keycloak package. OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS...

CLEANSTART-2026-XV49388 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-CY18985 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-OY76319 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-IB35002 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-XD72038 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

PT-2026-120329

Summary sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthet...

Google Chrome Vulnerability: CVE-2026-113196

Improper access control in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Google Chrome Vulnerability: CVE-2026-112999

Use after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...