CVE-2026-86431

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

PT-2026-86797

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handler...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...

PT-2026-71345

Name of the Vulnerable Software and Affected Versions Loofah versions 2.25.0 through 2.25.1 Description Loofah is a library for manipulating and transforming HTML/XML documents and fragments. The allowed uri? function within Loofah::HTML5::Scrub fails to reject javascript: URIs when the scheme is...