Lucene search
+L

11210 matches found

NVD
NVD
added 2026/09/01 9:18 p.m.10 views

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

6.1CVSS0.00279EPSS
SaveExploits0References10
NVD
NVD
added 2026/09/01 9:18 p.m.8 views

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

8.2CVSS0.00336EPSS
SaveExploits0References10
NVD
NVD
added 2026/09/01 9:18 p.m.11 views

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

5.4CVSS0.00185EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/01 8:51 p.m.38 views

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

5.4CVSS0.00185EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/01 8:51 p.m.20 views

EUVD-2026-69654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

5.4CVSS5.9AI score0.00185EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 8:51 p.m.21 views

CVE-2026-84371

ApostropheCMS (Node.js CMS) shipped a sanitize-html package vulnerable to stored XSS via SVG SMIL animation elements from version 1.9.0 through 2.17.7 . The root cause is in packages/sanitize-html/index.js, which validates the values attribute as a single flat URL, failing to account for SVG SMIL...

5.4CVSS5.9AI score0.00185EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/01 8:51 p.m.6 views

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

5.4CVSS5.9AI score
SaveExploits0References7
OSV
OSV
added 2026/09/01 8:47 p.m.4 views

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

8.2CVSS5.9AI score
SaveExploits0References12
Vulnrichment
Vulnrichment
added 2026/09/01 8:47 p.m.10 views

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

8.2CVSS5.5AI score0.00336EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/09/01 8:47 p.m.36 views

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

8.2CVSS0.00336EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/09/01 8:43 p.m.39 views

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

6.1CVSS0.00279EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/09/01 3:18 p.m.12 views

EUVD-2026-69293

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/01 3:18 p.m.33 views

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

5.4CVSS0.00176EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 3:18 p.m.15 views

CVE-2026-84232

CVE-2026-84232 is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (python-pulpcore). The root cause is that files uploaded to Pulp file-type repositories are served with their original MIME type (e.g., text/html, image/svg+xml) and without a Content-Dis...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/09/01 3:18 p.m.13 views

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/01 3:18 p.m.7 views

CVE-2026-84232

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/01 9:53 a.m.5 views

ROOT-APP-NPM-CVE-2021-28092 CVE-2021-28092 in is-svg - Patched by Root

Root has patched CVE-2021-28092 in the is-svg package for Root:npm. Multiple fixed versions available...

7.5CVSS6.7AI score0.02168EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.17 views

PT-2026-84509

Name of the Vulnerable Software and Affected Versions sanitize-html versions 1.9.0 through 2.17.6 Description In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, the packages/sanitize-html/index.js file fails to correctly validate the values...

5.4CVSS5.9AI score0.00185EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.16 views

PT-2026-84508

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3 incompletely filters executable links within...

8.2CVSS5.9AI score0.00336EPSS
SaveExploits0References17
Positive Technologies
Positive Technologies
added 2026/09/01 12:00 a.m.11 views

PT-2026-84507

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...

6.1CVSS5.8AI score0.00279EPSS
SaveExploits0References16
Rows per page
Query Builder