CVE-2020-11022-CVE-2020-11023

CVE-2020-11022 CVE-2020-11023 En versiones de jQuery mayores o iguales a 1.2 y anteriores a 3.5.0, pasar HTML de fuentes no confiables, incluso después de sanitizarlo, a uno de los métodos de manipulación del DOM de jQuery es decir, .html, .append y otros puede ejecutar código no confiable. Este...

CVE-2026-66829

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

EEF-CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps...

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-66843

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

EEF-CVE-2026-66843 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Summary Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing...

Cross-site Scripting (XSS)

JupyterLab is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation of data-commandlinker- attributes in sanitized HTML output, which allows an attacker to craft a malicious notebook containing a deceptive button that executes arbitrary JupyterLab commands,...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers such as script, xmp, iframe,...

EUVD-2025-6278

Malicious code in bioql PyPI...

CVE-2025-25625: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on t...

CVE-2025-25625

A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on t...

Medium: python-lxml

Issue Overview: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this...

SUSE CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-2563)

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms argument...