java-html-sanitizer

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The existing dependency is on JSR 305. The other jars are only needed by the test suite. The JSR 305...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-4103

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103 Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

EUVD-2026-77586

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

CVE-2026-4103

CVE-2026-4103 is a stored cross-site scripting (XSS) vulnerability in WSO2 API Manager's Publisher Portal and Developer Portal , caused by insufficient HTML sanitization that allows untrusted user input to be rendered without proper encoding or neutralization. When affected API documents are view...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get...

CVE-2026-90772

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

EUVD-2026-76993

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772

Amundsen frontend through 4.3.0 is affected by a stored XSS in ResourceListItem components (e.g., TableListItem), which render table, dashboard, and feature descriptions using dangerouslySetInnerHTML without HTML sanitization. An attacker with low privileges can inject malicious markup (such as )...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

PT-2026-90839

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Supports Java 7+. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc...

RLSA-2026:66204 Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2025-25296

CVE-2025-25296 概念実証（POC） 説明 このプロジェクトは、オープンソースのデータラベリングツールであるLabel Studioに影響を与えるCVE-2025-25296の脆弱性に対する概念実証（POC）を示しています。この脆弱性は/projects/upload-exampleエンドポイントに存在し、GETリクエスト内のユーザー提供のHTMLコンテンツをサニタイズしないことが原因です。これにより、攻撃者は被害者のブラウザで任意のJavaScriptを実行でき、クロスサイトスクリプティング（XSS）攻撃につながる可能性があります。 脆弱性の詳細 影響を受けるコンポーネント...

CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...

CVE-2026-22849

CVE-2026-22849: Saleor 富文本字段缺少适当的 HTML 净化处理 概述 字段| 详情 ---|--- CVE ID| CVE-2026-22849 严重性| HIGH 安全公告| 查看安全公告 发现者| Lukasz Rybak 受影响产品 saleor/saleor 详情 Saleor 允许用户使用 HTML 修改富文本字段，而未在后端运行任何 HTML 净化器，从而允许恶意行为者对仪表板和店面执行存储型 XSS 攻击。 影响 恶意员工可以构造脚本注入来针对其他员工，可能窃取他们的访问令牌和/或刷新令牌。 缓解措施...

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

EUVD-2026-75116

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...