CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

CVE-2026-75828

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-75828

Grav before 2.0.15 has a stored XSS flaw in its detectXss() sanitizer: unpaired quotes in unquoted attribute values let authenticated editors inject event handlers like onerror= that bypass validation and execute in visitor browsers. CVSS 4.0 scores this critical (9.3). Upgrade to Grav 2.0.15 to ...