List of Security Fixes and Improvements in Veeam Backup for Microsoft 365

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup for Microsoft 365. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases to help...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538 HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

EUVD-2026-109908

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-116538

The HtmlSanitizer library (versions before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is that the SanitizeDom(string) function fails to sanitize attributes on the and wrapper elements. An attacker can provide input containi...

PT-2026-123391

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDomstring never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like...

CVE-2026-56735

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

EUVD-2026-87215

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735

The open source helpdesk system Zammad is vulnerable to an oversight in its HTML sanitizer (HtmlSanitizer::Strict ). Prior to versions 7.0.2 and 7.1.0 , the sanitizer blocked external URLs in tags but failed to apply the same check to the srcset attribute. An attacker can bypass external content...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

GHSA-QXG3-46RW-79J8 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...

CVE-2026-56735: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

PT-2026-98949

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description The HTML sanitizer HtmlSanitizer::Strict fails to block external URLs within the srcset attribute of tags. While other external URLs are blocked to prevent remote conten...

CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...