CLEANSTART-2026-TS90060 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the consul package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-NS73897 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-LK92318 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

bleach

Bleach 참고: 2026-06-05: Bleach는 더 이상 유지보수되지 않습니다. 보안 문제를 포함한 향후 릴리스는 없습니다. 관련 이슈: Bleach는 허용 목록 기반 HTML 정화 라이브러리로, 마크업과 속성을 이스케이프 또는 제거합니다. Bleach는 또한 Django의 urlize 필터가 할 수 없는 필터를 적용하여 텍스트를 안전하게 링크화할 수 있으며, 이미 텍스트에 있는 링크에도 선택적으로 rel 속성을 설정할 수 있습니다. Bleach는 신뢰할 수 없는 출처의 텍스트를 정화하기 위해 설계되었습니다. 사이트...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

UBUNTU-CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

Google Chrome < 154.0.8037.97 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop advisory. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remo...

CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

CVE-2026-104900: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked...

CVE-2026-104450: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action tools/attach/actions/pointimage.php, which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering...

PT-2026-104395

Name of the Vulnerable Software and Affected Versions prosemirror-view versions prior to 1.42.3 Description The view component, which manages the editable browser interface for documents, contains a flaw in its paste handling. It accepts attacker-provided HTML where the clipboard slice context...

PT-2026-104280

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7 Description A server-side request forgery SSRF issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the url parameter. By embedding this action with ...

CVE-2026-103627: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-104906: Improper Neutralization of Input During Web Page Generation

MISP contains a cross-site scripting XSS vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII objec...

CVE-2026-93756: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

RHCOS 4 : OpenShift Container Platform 4.18.56 (RHSA-2026:70614)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70614 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 -...

CVE-2026-1661: Improper Neutralization of Input During Web Page Generation

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-104413: Improper Neutralization of Input During Web Page Generation

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or...

attackmapper

AttackMapper 공격 경로 시각화 및 위협 인텔리전스 플랫폼 기능 • 설치 • 사용법 • 위협 인텔 • 기여 개요 AttackMapper 는 레드 팀 운영을 위한 CLI 도구로, 공격 경로를 생성하고, MITRE ATT&CK 프레임워크에 기술을 매핑하며, 실시간 위협 인텔리전스를 통합합니다. 공격 흐름 시각화가 포함된 대화형 HTML 보고서를 생성합니다. 기능 기능| 설명 ---|--- 공격 경로 매핑| 정찰부터 영향까지 전체 킬 체인 시각화 MITRE ATT &CK 통합| 공식 ATT&CK 프레임워크에 매핑된 기술 실...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...