119029 matches found
CLEANSTART-2024-XV41479 HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes
Security vulnerability affects the firefox package. The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however it incorrectly did not sanitize xlink:href attributes...
CLEANSTART-2024-NY00424 html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts
Security vulnerability affects the go package. The html/template package does not apply the proper rules for handling occurrences of " contexts...
CLEANSTART-2024-YS51901 html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts
Security vulnerability affects the go package. The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts...
CLEANSTART-2026-PD81814 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
CVE-2026-27142 affects multiple packages. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. See references for individual vulnerability details...
CLEANSTART-2026-XN07302 html
CVE-2025-47911 affects multiple packages. The html. See references for individual vulnerability details...
CLEANSTART-2026-QV71664 html
CVE-2025-58190 affects multiple packages. The html. See references for individual vulnerability details...
cve-2026-80428-ctf
CVE-2026-80428 CTF Training Lab Educational emulator of the vulnerability mechanics described in CVE-2026-80428 CWE-502: Deserialization of Untrusted Data. This is not a real ILIAS installation and not a weaponized exploit package. It is a fully containerized, isolated laboratory for students,...
CLEANSTART-2026-XF18056 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-RM34331 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-ZT51692 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-JU11428 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-RU87499 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CVE-2026-105454
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...
CVE-2026-105454
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...
CVE-2026-118015
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component Mitigation --- CME Mitigation Guidance 2026-11-03 --- Disclaimer: The following mitigation solutions are provided as a courtesy,...
EUVD-2026-114131
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...
CVE-2026-105454 Stored XSS via crafted URLs in HTML ticket content in Request Tracker
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...
CVE-2026-105454
Request Tracker (RT) is vulnerable to Stored XSS because its automatic link creation for URLs in HTML ticket content fails to HTML-escape the inserted URL. An attacker can craft a URL to break out of the link attribute and inject a script. This script executes when any user views the ticket histo...
CVE-2026-105454 Stored XSS via crafted URLs in HTML ticket content in Request Tracker
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...
CVE-2026-105454 Stored XSS via crafted URLs in HTML ticket content in Request Tracker
RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content ...