PT-2026-108127

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A logic error exists in the way SVG href values are validated. The isHrefSafeValue function validates the SVG href after XML DTD entity expansion, but the saveXML function serializes t...

CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and xlink:href attribut...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SVG sanitizer's handling of the href attribute, which restricts xlink:href on SVG...

Exploit for CVE-2026-25916

CVE-2026-25916: Roundcube Webmail DOM XSS Exploit 📋 Exploi...

Linux Distros Unpatched Vulnerability : CVE-2026-22610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18,...

DEBIAN-CVE-2026-22610

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting XSS vulnerability has been identified in the Angular Template Compiler. The...

Angular 跨站脚本漏洞

Angular is Angular open source a development platform . Used to build mobile and desktop Web applications using Typescript / JavaScript and other languages. A cross-site scripting vulnerability exists in Angular versions prior to 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0 that stems from an intern...

Incomplete Filtering of Special Elements

Overview Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements due to improper sanitization of the href and xlink:href attributes in SVG elements. An attacker can bypass image source restrictions and negatively affect the application's performance and behavi...

DEBIAN-CVE-2023-24813

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of image tags and respects xlink:href even if href is specified. However...