CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CLSA-2026-1775694727 TuxCare security update for angular-sanitize (1 CVE)

TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

CVE-2026-33979

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

Sanitize::Config::RELAXED Component XSS

The vulnerability of the Sanitize::Config::RELAXED component in the Sanitize library for the Ruby programming language is related to the lack of measures taken to protect the structure of web pages when processing style elements. Exploiting this vulnerability allows a remote attacker to perform...

Sanitize Ruby Library Confidential Data Access DoS

The vulnerability of the Sanitize library for the Ruby programming language is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service...

Sanitize Library HTML Attribute Bypass

The vulnerability of the Sanitize library for the Ruby programming language is related to input validation errors. Exploiting this vulnerability could allow an attacker to circumvent the specified restrictions on the use of HTML attributes...