CVE-2026-74944: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4837 more potentially affected by CVE-2026-63670 via sanitize-html (>=0.1.4, <=2.17.5)

sanitize-html NPM version =0.1.4, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =0.1.0, =0.1.0, =11.1.0, =1.3.0, =1.3.6 and more Source cves: CVE-2026-63670 Source advisory: MEND:CVE-2026-63670...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

GHSA-2JP7-WWPG-3P9W Etherpad has stored XSS in HTML export via unescaped attribute-pool values

Fix: PR 7905 ether/etherpad. getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-="" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a craft...

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

Fix: PR 7905 ether/etherpad. getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-="" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a craft...

NPM: Etherpad has stored XSS in HTML export via unescaped attribute-pool values

NPM: Etherpad has stored XSS in HTML export via unescaped attribute-pool values vulnerability discovered by ? in WordPress Npm epetherpad-lite versions = 1.8.14...

ANT-2026-MHJX7J31 · typo3 · XSS

xss medium CVE-2026-47345 GHSA-p5j5-4j3q-8mq8 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-MHJX7J31: Stored XSS in TYPO3...

CVE-2026-13202 HTML Injection in OTDS Swagger UI

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

CVE-2026-13202 HTML Injection in OTDS Swagger UI

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

UBUNTU-CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

UBUNTU-CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75006

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...