CVE-2026-68750

CVE-2026-68750 affects the html_sanitize_ex crate (versions 0.3.1 up to, but not including, 1.5.3). The vulnerability is a quadratic-time CPU/memory exhaustion in the HTML traversal engine when sanitizing large sibling lists; the traverser recurses on the tail and repeatedly flattens lists, causi...

CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

EUVD-2026-54085

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

CVE-2026-68749

The vulnerability CVE-2026-68749 affects the html_sanitize_ex Ruby gem (versions before 1.5.3; affected range includes 0.3.1–1.5.2). It stems from an inefficient greedy regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 that backtracks on long CSS declarations, causing quadratic CPU consumption and pot...

CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

EUVD-2026-54084

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

CVE-2026-68747

Technical details about CVE-2026-68747 are not publicly provided in the supplied documents. No information on affected versions, exploit vectors, or fixes is available here. Monitor for updates from the referenced advisories.

EUVD-2026-54083

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-66829

The CVE concerns html_sanitize_ex (rrrene) with a flaw in html5 scrubber output: attacker-supplied elements are not sanitized, enabling an Open Redirect by navigating the whole document to an attacker-chosen site. The vulnerability affects html_sanitize_ex versions prior to 1.5.3 (from 0.3.1 up to

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

EUVD-2026-54082

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...

CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...

EUVD-2026-54080

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CVE-2026-11588

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation

The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...