CLSA-2026-1781657704 TuxCare security update for angular-sanitize (1 CVE)

TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.5.5-tuxcare.1...

CLSA-2026-1776645373 TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.3...

CLSA-2026-1775694723 TuxCare security update for angular-sanitize (1 CVE)

TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.8.2-tuxcare.1...

CLSA-2026-1775694728 TuxCare security update for angular-sanitize (2 CVEs)

TuxCare rebuilt angular-sanitize to address 2 CVEs. Fixed in 1.6.10-tuxcare.1...

CLSA-2026-1775694727 TuxCare security update for angular-sanitize (1 CVE)

TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.8.3-tuxcare.1...

CLSA-2026-1776644763 TuxCare security update for sanitize-html (3 CVEs)

TuxCare rebuilt sanitize-html to address 3 CVEs. Fixed in 1.27.5-tuxcare.2...

CLSA-2026-1775003160 TuxCare security update for sanitize-html (1 CVE)

TuxCare rebuilt sanitize-html to address 1 CVE. Fixed in 1.27.5-tuxcare.1...

SUSE CVE-2026-44990

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of sanitize-html prior to 2.17.4 can turn attacker-controlled content inside a disallowed xmp element into live HTML or...

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Summary The subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4544 more potentially affected by CVE-2026-53606 via sanitize-html (>=1.18.2, <=2.17.4)

sanitize-html NPM version =1.18.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =11.1.0, =11.3.0 and more Source cves: CVE-2026-53606 Source advisory: OSV:GHSA-VCCV-CMXP-4J9H...

EUVD-2026-36574

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes...

GHSA-VCCV-CMXP-4J9H sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.18.0, = 2.17.4...

Cross-site Scripting (XSS)

Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitizeHTMLElement. An attacker can execute arbitrary JavaScript in the context of the user's browser by crafting a malicious href...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

EUVD-2026-51621

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

EUVD-2026-51419

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

CVE-2026-14922 WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...