CVE-2026-22849

CVE-2026-22849: Saleor のリッチテキストフィールドにおける適切な HTML サニタイゼーションの欠如 概要...

nahsra__antisamy_CVE-2022-29577_1-6-6-1

AntiSamy مكتبة لإجراء تنظيف سريع وقابل للتهيئة لـ HTML الوارد من مصادر غير موثوقة. تدعم Java 7+. يمكن التعبير عن ذلك بطريقة أخرى: إنها API تساعدك على التأكد من أن العملاء لا يوفّرون حمولة شيفرة خبيثة في HTML الذي يرسلونه لملفاتهم الشخصية أو تعليقاتهم وما إلى ذلك، والذي يُحفظ على الخادم. يُقصد...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy مكتبة لإجراء تعقيم سريع وقابل للتكوين لـ HTML القادم من مصادر غير موثوقة. هناك طريقة أخرى لقول ذلك وهي: إنها واجهة برمجة تطبيقات API تساعدك على التأكد من أن العملاء لا يقدمون كود حمولة خبيث في HTML الذي يقدمونه لملفاتهم الشخصية أو تعليقاتهم، وما إلى ذلك، والتي يتم حفظها على الخادم. مصطلح...

CVE-2024-42009

CVE-2024-42009 – XSS Memorizzato in Roundcube PoC Docker 📌 Panoramica Questo repository dimostra un Proof-of-Concept PoC funzionante per CVE-2024-42009 , una vulnerabilità di Cross-Site Scripting XSS memorizzata in Roundcube Webmail. La vulnerabilità è causata da una sanitizzazione HTML impropria...

java-html-sanitizer

OWASP Java HTML Sanitizer Un sanificatore HTML veloce e facile da configurare scritto in Java che ti consente di includere HTML creato da terze parti nella tua applicazione web proteggendoti da XSS. La dipendenza esistente è su JSR 305. Gli altri jar servono solo per la suite di test. La dipenden...

CVE-2025-25296

CVE-2025-25296 Proof of Concept POC Beschreibung Dieses Projekt demonstriert einen Proof of Concept POC für die Schwachstelle CVE-2025-25296, die Label Studio betrifft, ein Open-Source-Tool zur Datenbeschriftung. Die Schwachstelle befindet sich im Endpunkt /projects/upload-example, der die von...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-7808

justhtml (Python HTML parsing library) before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active content such as [removed] or to survive sanitization, potentially leading to cross-site scripting . The issues primarily affect advanced usage rather than the default Just...

CVE-2026-61824 Defuddle: XSS via unescaped attribute interpolation in site extractors

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

EUVD-2026-62932

In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...

CVE-2026-76367

In Splunk SOAR versions below 8.6.0, the Notes feature fails to sanitize content when a note's format changes, allowing an "Incident Commander" role user to store JavaScript that executes in another user's browser upon viewing. This stored XSS requires phishing the target to initiate a browser re...

BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-16627

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...

PT-2026-71199

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an authenticated user with developer-role permissions could escalate privileges. This occurs due to improper sanitization of HTML content rendered within a CI job moda...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...