CVE-2026-65591

CVE-2026-65591 Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions ...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...

Stirling-PDF SSRF via Markdown

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

Stirling-PDF < 1.1.0 - Server-Side Request Forgery

Stirling-PDF 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access. id: CVE-2025-55150 info: name: Stirling-PDF 1.1.0 - Server-Si...

Linux Distros Unpatched Vulnerability : CVE-2026-88057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, a...

DEBIAN-CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

PT-2026-89561

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

PT-2026-89692

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

CVE-2026-28134

CVE-2026-28134 Exploitation Report JetEngine = 3.7.2 — Authenticated Contributor+ Remote Code Execution via Twig SSTI Date: March 11, 2026 CVSS Score: 8.8 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Plugin: JetEngine = 3.7.2 Plugin Slug: jet-engine CVE: CVE-2026-28134...

PT-2026-88507

Impact The expression compiler's sanitizer resolved through a dynamically-scoped this, so a class field named sanitize rebound it and reached the Function constructor. On the backend, any expression author could run code in the n8n process; in the editor preview, a member's expression could run a...

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

GHSA-99RQ-75J6-5J9F SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

Summary SiYuan cleans user supplied SVG with util.SanitizeSVG before it serves the file inline as image/svg+xml. This cleaner is the guard behind the Editor.AllowSVGScript setting, which is off by default, so a inside an SVG is meant to be removed. The cleaner reads the input as HTML, but the...

EUVD-2026-68218

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri . In versions prior to 0.11.16 , the EPUB HTML sanitizer (DOMPurify) in apps/readest-app/src/services/transformers/sanitizer.ts forbade only the [removed] tag. Because DOMPurify treats the srcdoc attribute on elements as an opaque string, a ...

Astra Linux – Vulnerability in Firefox

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox versions earlier than 86...

CVE-2026-8445

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting whe...

CVE-2026-74793

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...