Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

Stirling-PDF < 1.1.0 - Server-Side Request Forgery

Stirling-PDF 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access. id: CVE-2025-55150 info: name: Stirling-PDF 1.1.0 - Server-Si...

CVE-2026-65591

CVE-2026-65591 脆弱なソフトウェアの名称と影響を受けるバージョン 1.123.64 より前の n8n バージョン 2.29.8 より前の n8n バージョン 2.30.1 より前の n8n バージョン 説明 レガシー式評価機の computed-member ハンドラにサニタイザーバイパスが存在します。ワークフローの作成または変更権限を持つ認証済みユーザーは、悪意のある式を作成してサニタイザーをバイパスし、n8n プロセスの権限でホストレベルのコード実行を引き起こす可能性があります。レガシー式エンジンは影響を受けるバージョンのデフォルトです。 推奨事項 バージョン...

CVE-2026-47423-dompurify-xss-detector

DOMPurify 的重新克隆逻辑缺陷。 该工具不依赖容易被剥离的源码注释或版本变量，而是通过逻辑指纹识别技术分析压缩的生产环境 JavaScript 包，识别未修补的允许标签配置。 漏洞概要 在 DOMPurify 版本 3.4.4 及之前， 元素默认被允许。这引入了一个逻辑缺陷：Chromium/WebKit 浏览器会在 DOMPurify 完成消毒处理后，刷新并重新克隆 子树，导致当负载被注入实时 DOM 时，发生绝对 XSS 绕过。 功能特性 框架无关（适用于 React、Vue、Angular 或原生 JS 包结构） 从根路径自动解析动态 JS 资源...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-54645

CubeCart is an e-commerce platform where a stored XSS vulnerability exists in the product management panel prior to version 6.7.5. In admin/sources/products.index.inc.php (lines 55–59), the application bypasses its global sanitizer by reading description, description_short, and spec_copy fields d...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-28134

CVE-2026-28134 エクスプロイト報告書 JetEngine = 3.7.2 — Twig SSTI による認証済み（Contributor+）リモートコード実行 日付: 2026年3月11日 CVSSスコア: 8.8（高） CVSSベクター: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 影響を受けるプラグイン: JetEngine = 3.7.2 プラグインスラッグ: jet-engine CVE: CVE-2026-28134 ステータス: 非公開 テスト済みWordPressバージョン: 最新 エグゼクティブサマリー...

Astra Linux – Vulnerability in Firefox

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox versions earlier than 86...

Linux Distros Unpatched Vulnerability : CVE-2026-88057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, a...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

DEBIAN-CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

PT-2026-89561

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

PT-2026-89692

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

PT-2026-88507

Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

GHSA-99RQ-75J6-5J9F SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

Summary SiYuan cleans user supplied SVG with util.SanitizeSVG before it serves the file inline as image/svg+xml. This cleaner is the guard behind the Editor.AllowSVGScript setting, which is off by default, so a inside an SVG is meant to be removed. The cleaner reads the input as HTML, but the...

EUVD-2026-68218

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...