CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

EUVD-2026-55236

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

EEF-CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Summary Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html\sanitize\ex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2...

EUVD-2026-54085

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

CVE-2026-66829

The CVE affects html_sanitize_ex (HtmlSanitizeEx.html5/1) where attacker-supplied meta refresh elements survive sanitization. The root cause is that a meta element can apply document-wide directives, enabling open redirects to user-chosen sites via a tag. Affected versions: html_sanitize_ex from...

EUVD-2026-54082

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-71233

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...

CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...

CVE-2026-71233

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...

CVE-2026-65841

CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...

CVE-2026-17496

NoteGen prior to 0.32.0 renders AI chat responses using markdown-it with html:true and injects output into the chat-preview DOM via dangerouslySetInnerHTML without HTML sanitization and with CSP set to null. Attackers can inject content (e.g., a malicious REFERENCE.md) that instructs the model to...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

CVE-2026-59923

A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows an attacker to bypass URL protections by using specially crafted Markdown links or images containing percent-encoded javascript URIs. This can lead to the execution of arbitrary scripts in the rendered HTML,...

CVE-2026-54002 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize, Sane::sanitize, Sane::Html::sanitize, Sane::Svg::sanitize, Sane::Xml::sanitize, Sane::sanitizeFile, or file sanitizeContents with untruste...

Cross-site Scripting (XSS)

Overview org.webjars.npm:jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS via the safeHTML sanitizer in src/core/helpers/html/safe-html.ts and the clean-html plugin’s value-set/on-change...

Cross-site Scripting (XSS)

Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS via the safeHTML sanitizer in src/core/helpers/html/safe-html.ts and the clean-html plugin’s value-set/on-change sanitization paths. An...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

Gogs has DOM-based XSS via Milestone Name on New Issue Page

Summary The fix for GHSA-vgjm-2cpf-4g7c DOM-based XSS via milestone selection was only applied to templates/repo/issue/viewcontent.tmpl but not to templates/repo/issue/newform.tmpl. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page an...