nmap-bootstrap-xsl

nmap-bootstrap-xsl Have a nice interface for checking the result of your Nmap scans. This software must not be used by military or secret service organisations. How to use 1. New Nmap scan Add the nmap-bootstrap.xsl as stylesheet to your Nmap scan with the --stylesheet argument : nmap -sS -T4 -A...

CVE-2026-61847

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted stylesheet containing a large number of adjacent comments. Because the parser recursively processes comments when discarding them, handling these consecutive comments triggers excessiv...

CVE-2026-114731

A flaw was found in Roundcube Webmail. This flaw allows a remote attacker to trigger a Denial of Service DoS by exhausting server memory. The application's stylesheet proxy fails to enforce size limits or read timeouts when retrieving external content. By directing the proxy to fetch an...

CVE-2026-118660

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

GHSA-C8P4-J97H-3VG8 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Summary happy-dom v20.8.9 makes real server-side HTTP requests to arbitrary URLs when parsing HTML containing or elements. This behavior is enabled by default disableIframePageLoading: false, disableCSSFileLoading: false. When an application uses happy-dom to parse untrusted HTML on the server...

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML vulnerability discovered by ? in WordPress npm happy-dom versions = 20.14.6...

EUVD-2026-112467

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

CVE-2026-118660

Prior to version 21.0.0 , the Happy DOM JavaScript library is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the library defaults disableIframePageLoading and disableCSSFileLoading to false, causing it to automatically load iframe src and link rel="stylesheet" URLs when...

CVE-2026-118660: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

David Ortner Happy DOM server-side request forgery vulnerability

David Ortner: Versions prior to Happy DOM 21.0.0 contain a server-side request forgery vulnerability. This vulnerability arises because, when parsing untrusted HTML on the server, the default behavior loads iframe src URLs and link rel="stylesheet" href URLs. This may lead to server-side request...

PT-2026-129180

Name of the Vulnerable Software and Affected Versions happy-dom versions prior to 21.0.0 Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. When parsing untrusted HTML on the server, the software loads iframe src URLs and link...

GHSA-994f-577q-hhph

GHSA-994f-577q-hhph — TypeMill stored XSS via SVG XML styleshe...

CVE-2026-112056

A flaw was found in wv. When parsing a Microsoft Word document containing malformed stylesheet data, the library fails to properly validate style indexes, leading to a heap-based out-of-bounds read. An attacker could exploit this vulnerability by enticing a user or automated service to open a...

CVE-2026-114127

A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrary Cascading Style Sheets CSS rules into server-rendered we...

CVE-2026-109574

A flaw was found in Hugo. A path traversal vulnerability in the Sass stylesheet processing component allows malicious themes or modules to access files outside the intended project directory. By supplying crafted stylesheet import directives, an attacker can read sensitive local files and include...

Astra Linux – Vulnerability in Firefox

By using XSL Transforms, a malicious webserver could serve a user an XSL document that would continue to execute JavaScript within the bounds of the same-origin policy even after the tab was closed. This vulnerability affects Firefox versions earlier than 97...