667 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-116802
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is...
CVE-2026-116802
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
SUSE CVE-2026-116802
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
CVE-2026-116802
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS. When configured to parse Extensible Hypertext Markup Language XHTML content, the library fails to properly normalize and sanitize attribute names within animation elements. An attacker...
EUVD-2026-110510
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
DEBIAN-CVE-2026-116802
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
CVE-2026-116802
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
CVE-2026-116802
Versions of DOMPurify prior to 3.4.17 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is that transformCaseFunc fails to lowercase attribute names, allowing attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is set to application/xhtml+xml. E...
CVE-2026-116802
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
PT-2026-125508
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER MEDIA TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...
npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSERMEDIATYPE is application/xhtml+xml vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.16...
GHSA-C6GR-QVV4-5V3F DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...
XSS-via-XML-Rendering
XSS via XML document This repo showcases how to exploit XH...
[SECURITY] Fedora 45 Update: xhtml1-dtds-1.0-20020801.26.fc45
This provides the DTDs of the Second Edition of XHTML 1.0, a reformulation of HTML 4 as an XML 1.0 application, and three DTDs corresponding to the ones defined by HTML 4. The semantics of the elements and their attributes are defined in the W3C Recommendation for HTML 4. These semantics provide...
CLEANSTART-2023-NC93847 xhtml_translate_entity in xhtml
Security vulnerability affects the epub2txt package. xhtmltranslateentity in xhtml...