CVE-2026-105950

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950 getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-105950

The getformwork formwork component, in versions up to 2.3.12 , is vulnerable to cross-site scripting (XSS) due to an issue in the URI Sanitizer component. Specifically, the DomSanitizer::sanitizeNodeAttribute function located in formwork/src/Sanitizer/DomSanitizer.php fails to properly handle the...

EUVD-2026-93467

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site...

CVE-2026-26022

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting XSS vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrar...