CVE-2026-73428: Improper Neutralization of Input During Web Page Generation

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...

PT-2026-71494

Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...

PT-2026-71493

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description A flaw exists where JavaScript responses containing data can be referenced by external pages. This may allow an attacker-controlled page to capture sensitive information through JavaScript...

PT-2026-71731

Name of the Vulnerable Software and Affected Versions NodeBB versions prior to 4.15.0 Description A stored cross-site scripting issue exists in the renderEmoji function. The function fails to properly escape the tag.icon.url and tag.name attributes. This allows attackers to send malicious...

PT-2026-71866

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

Linux Distros Unpatched Vulnerability : CVE-2026-73491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2,...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

DEBIAN-CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73427

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-73422

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value su...

UBUNTU-CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

EUVD-2026-57629

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73492

Loofah (Ruby, Nokogiri-based) versions 2.25.0–2.25.2 expose a vulnerability in Loofah::HTML5::Scrub.allowed_uri?, where javascript: or vbscript: URIs split by semicolon-less numeric character references (e.g., &#58, &#9, &#10, &#13) are not rejected. CGI.unescapeHTML leaves these references encod...

CVE-2026-73492 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references...

CVE-2026-73491

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...