CVE-2026-105708 imgproxy SVG svg.go sanitizeElement cross site scripting

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...

CVE-2026-105708 imgproxy SVG svg.go sanitizeElement cross site scripting

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...

EUVD-2026-92960

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...

CVE-2026-105708

A flaw in the SVG Handler component of imgproxy (versions up to 4.0.17 ) allows for Cross-Site Scripting (XSS) . The vulnerability exists in the sanitizeElement function within the processing/svg/svg.go file. This flaw can be triggered via a remote manipulation attack. While the exploit has been ...

CVE-2026-105708 imgproxy SVG svg.go sanitizeElement cross site scripting

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...

CVE-2026-94545

CVE-2026-94545 Next.js next/og 未認証RCE ★ CVE-2026-94545 Next.js next/og SVGインジェクションからネイティブRCEへ ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 概要 next/og は、JSXをSatoriでSVGにレンダリングし、そのSVGをラスタライズすることでOpen...

PT-2026-106323

A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...

SUSE SLES15 Security Update : rubygem-rails-html-sanitizer (SUSE-SU-2026:4445-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4445-1 advisory. This update for rubygem-rails-html-sanitizer fixes the following issue: - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when t...

CVE-2026-105862: Improper Neutralization of Input During Web Page Generation

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a use...

PT-2026-106795

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description A collection that allows downloadable SVG uploads can store a malicious SVG file. This file can bypass sanitization, allowing the execution of...

CVE-2022-32074

CVE-2022-32074 osTicket용 | 지원 티켓팅 시스템 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it 예시:...

CVE-2026-14856-TastyIgniter

CVE-2026-14856: TastyIgniter v4.3.0 における蓄積型 XSS からアカウント乗っ取りまで 📌 概要 TastyIgniter v4.3.0 の Media Manager におけるファイルアップロード機能に、蓄積型クロスサイトスクリプティング XSS 脆弱性が確認されました。アップロードされた .svg ファイルの検証およびサニタイズが不十分であるため、認証済みの低権限ユーザーが JavaScript コードを埋め込んだ悪意のあるファイルをアップロードできます。...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-103627

An information leak flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553147154...

CVE-2026-103622

An use after free flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742179...

CVE-2026-105694

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105691

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...