155 matches found
Rocky Linux 8 [CIQ] Security Update: python3-lxml / python3-lxml-debuginfo (crlsa-2021_1898)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211898 advisory. python-lxml: mXSS due to the use of improper parser CVE-2020-27783 Tenable has extracted the preceding description block directly from the CIQ security advisory. No...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914)
Summary Multiple HTML sanitization and mutation Cross-Site Scripting mXSS vulnerabilities in the DOMPurify library CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914 used by IBM InfoSphere Optim Archive...
Oracle Linux 8 : python-lxml (ELSA-2026-67943)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-67943 advisory. - Security fix for CVE-2026-49825: missing xlink:href in known HTML link attributes Resolves: RHEL-251508 - Security fix for CVE-2021-43818 Resolves: rhbz20325...
python-lxml security update
4.2.3-5 - Security fix for CVE-2026-49825: missing xlink:href in known HTML link attributes Resolves: RHEL-251508 4.2.3-4 - Security fix for CVE-2021-43818 Resolves: rhbz2032569 4.2.3-3 - Security fix for CVE-2021-28957 Resolves: rhbz1941534 4.2.3-2 - Security fix for CVE-2020-27783: mXSS due to...
CVE-2026-8630
justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...
CVE-2026-5751
justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting mXSS vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces e.g., dropforeignnamespaces=False with allowlisted SVG/MathML elements or raw-text containers such as...
CVE-2026-8630: Improper Neutralization of Input During Web Page Generation
justhtml before 1.12.0 versions = 1.11.0 contains a mutation cross-site scripting mXSS vulnerability in the serialization of raw-text elements such as...
CVE-2026-5751: Improper Neutralization of Input During Web Page Generation
justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting mXSS vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces e.g., dropforeignnamespaces=False with allowlisted SVG/MathML elements or raw-text containers such as...
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces a DOM...
Security Bulletin: IBM Jazz Reporting Service is affected by Nesting-Based mXSS Vulnerability of DOMPurify
Summary DOMPurify is used internally by IBM Jazz Reporting Service CVE-2024-47875, CVE-2024-45801, CVE-2024-48910, CVE-2026-41239, CVE-2026-41240, CVE-2025-26791. Vulnerability Details CVEID:CVE-2024-47875 DESCRIPTION: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML,...
mXSS in ammonia via MathML `annotation-xml` encoding strip
If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The annotation-xml tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the...
mXSS (mutation Cross-Site Scripting) dompurify Dependency in Jira Service Management Data Center and Server
This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity nesting-based mXSS mutation Cross-Site Scripting vulnerability was introduced in version 10.3.0 of Jira...
PT-2026-30777
Description A mutation-XSS mXSS condition was confirmed when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers. The vulnerable wrappers confirmed in browser behavior are script, xmp, iframe, noembed, noframes, and noscript. The payload remains seemingly...
MiracleLinux 8 : python38:3.8 (AXSA:2021-2422:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2422:01 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python-lxml: mXSS due to the use of improper parser...
mXSS (mutation Cross-Site Scripting) dompurify Dependency in Jira Software Data Center and Server
This is a vulnerability in a non-Atlassian Jira dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity nesting-based mXSS mutation Cross-Site Scripting vulnerability was introduced in version 10.3.0 of Jira Software Data Center...
TencentOS Server 3: grafana (TSSA-2024:0734)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0734 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
EUVD-2021-10895
Malware in sbrugna...