GHSA-QC95-4862-92FH Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Description symfony/html-sanitizer lets applications sanitise untrusted HTML. The configuration methods allowLinkHosts... and allowLinkSchemes... are intended to restrict targets to an allowlist of hosts/schemes; allowMediaHosts / allowMediaSchemes do the same for etc. Three distinct bypasses all...

CVE-2024-24790

creationtimestamp| type| source ---|---|--- 2026-05-27 19:48:15+00:00| seen| https://bsky.app/profile/andresbohren.bsky.social/post/3mmubm7gb3s22...

CVE-2023-24531

creationtimestamp| type| source ---|---|--- 2026-05-27 19:48:15+00:00| seen| https://bsky.app/profile/andresbohren.bsky.social/post/3mmubm7gb3s22 2026-06-12 13:00:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3sbe73cs2x...

CVE-2018-25357

creationtimestamp| type| source ---|---|--- 2026-05-27 18:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmu3xgipzu2w...

CVE-2026-48053

creationtimestamp| type| source ---|---|--- 2026-05-27 17:45:47+00:00| published-proof-of-concept| https://github.com/learningequality/kolibri/security/advisories/GHSA-4mj9-pf4r-cqrc...

CVE-2026-5509 Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the...

CVE-2026-44971

creationtimestamp| type| source ---|---|--- 2026-05-27 17:02:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmtyefixwt2n...

CVE-2026-9617

creationtimestamp| type| source ---|---|--- 2026-05-27 16:38:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmtwz2lusu2v...

CVE-2026-49982

creationtimestamp| type| source ---|---|--- 2026-05-27 15:48:27+00:00| published-proof-of-concept| https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm 2026-06-11 18:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnzslz7nzj25 2026-06-15...

CVE-2026-46035

creationtimestamp| type| source ---|---|--- 2026-05-27 15:40:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116647290931030330 2026-07-02 06:48:22+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260702...

EUVD-2026-32257

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR hang in LAG error state unload During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unload. See 1. In LAG mode the bond devic...

EUVD-2026-32381

In the Linux kernel, the following vulnerability has been resolved: fat: avoid parent link count underflow in rmdir Corrupted FAT images can leave a directory inode with an incorrect inlink e.g. 2 even though subdirectories exist. rmdir then unconditionally calls dropnlinkdir and can drive inlink...

CVE-2026-48903

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:37+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48901

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:36+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-48896

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq56q4l22q...

CVE-2026-32997

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq4ktlmj2b 2026-05-29 12:16:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116657815289026541 2026-06-23 12:05:28+00:00| seen|...

CVE-2026-32996

creationtimestamp| type| source ---|---|--- 2026-05-27 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmtq4ktlmj2b 2026-05-29 03:43:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116655797945283788 2026-06-23 12:05:28+00:00| seen|...

CVE-2026-7524

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction...

CVE-2026-7524

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction...

CVE-2026-46027

In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smcclcwaitmsg A CLC decline can be received while the handshake is still in an early stage, before the connection has been associated with a link group. The decline handling in smcclcwaitmsg...