CVE-2026-22849

CVE-2026-22849: Saleor non applica una corretta sanificazione HTML nei campi rich text Panoramica...

CVE-2025-25296

CVE-2025-25296 Proof of Concept POC Beschreibung Dieses Projekt demonstriert einen Proof of Concept POC für die Schwachstelle CVE-2025-25296, die Label Studio betrifft, ein Open-Source-Tool zur Datenbeschriftung. Die Schwachstelle befindet sich im Endpunkt /projects/upload-example, der die von...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy Una libreria per eseguire una pulizia rapida e configurabile dell'HTML proveniente da fonti non attendibili. Supporta Java 7+. Un altro modo per dirlo potrebbe essere: è un'API che ti aiuta a garantire che i client non forniscano codice dannoso nascosto nell'HTML che forniscono per il lo...

CVE-2024-42009

CVE-2024-42009 – XSS Armazenado no Roundcube PoC Docker 📌 Visão Geral Este repositório demonstra uma Prova de Conceito PoC funcional para CVE-2024-42009 , uma vulnerabilidade de Cross-Site Scripting XSS armazenado no Roundcube Webmail. A vulnerabilidade é causada por uma sanitização HTML inadequa...

java-html-sanitizer

OWASP Java HTML Sanitizer Um Sanitizador HTML rápido e fácil de configurar, escrito em Java, que permite incluir HTML criado por terceiros em sua aplicação web, protegendo contra XSS. A dependência existente é o JSR 305. Os outros jars são necessários apenas para a suíte de testes. A dependência...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy مكتبة لإجراء تعقيم سريع وقابل للتكوين لـ HTML القادم من مصادر غير موثوقة. هناك طريقة أخرى لقول ذلك وهي: إنها واجهة برمجة تطبيقات API تساعدك على التأكد من أن العملاء لا يقدمون كود حمولة خبيث في HTML الذي يقدمونه لملفاتهم الشخصية أو تعليقاتهم، وما إلى ذلك، والتي يتم حفظها على الخادم. مصطلح...

CVE-2026-7808

justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...

CVE-2026-61824 Defuddle: XSS via unescaped attribute interpolation in site extractors

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

EUVD-2026-62932

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-76367

In Splunk SOAR versions below 8.6.0, the Notes feature fails to sanitize content when a note's format changes, allowing an "Incident Commander" role user to store JavaScript that executes in another user's browser upon viewing. This stored XSS requires phishing the target to initiate a browser re...

BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-16627

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...