CVE-2025-71385

creationtimestamp| type| source ---|---|--- 2026-07-03 15:00:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqsr3la7t2u...

CVE-2025-71385

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document into a text element without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a U...