AFLTriage

AFLTriage AFLTriage is a tool to triage crashing input files using a debugger. It is designed to be portable and not require any run-time dependencies, besides libc and an external debugger. It supports triaging crashes generated by any program, not just AFL, but recognizes AFL directories...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

java-html-sanitizer

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The sanitizer JAR has no runtime dependencies. Its only compile-time dependency is spotbugs-annotations...

CVE-2026-128068

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128069

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without synchronization. In a multithreaded...

GHSA-H7WH-Q2QR-458C rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls

Summary Rails::HTML::SafeListSanitizer both the HTML4 and HTML5 variants shares one Rails::HTML::PermitScrubber across every sanitize call on the same instance, assigning its tags and attributes on each call without synchronization. Two concurrent sanitize calls with different tags: or attributes...

rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls

Summary Rails::HTML::SafeListSanitizer both the HTML4 and HTML5 variants shares one Rails::HTML::PermitScrubber across every sanitize call on the same instance, assigning its tags and attributes on each call without synchronization. Two concurrent sanitize calls with different tags: or attributes...

GHSA-CPGF-5MJF-73P7 rails-html-sanitizer: Possible regular expression denial of service with certain configurations

Summary Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s^\s./m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine resc...

rails-html-sanitizer: Possible regular expression denial of service with certain configurations

Summary Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s^\s./m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine resc...

svg-sanitizer

svg-sanitizer This is my attempt at building a decent SVG sanitizer in PHP. The work is largely borrowed from DOMPurify. Installation Either require enshrined/svg-sanitize through composer or download the repo and include the old way! Usage Using this is fairly easy. Create a new instance of...

EUVD-2026-125611

DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the classfilter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script withou...

CVE-2026-129155

DjangoBlog versions 2.0.0.0 through 2.1.0.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the class_filter comment sanitizer fails to strip event-handler attributes from span, div, pre, and code tags. This allows authenticated commenters to post malic...

EUVD-2026-125593

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without synchronization. In a multithreaded...

CVE-2026-128069 rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without synchronization. In a multithreaded...

CVE-2026-128069

The rails-html-sanitizer gem is vulnerable to Cross-Site Scripting (XSS) in versions prior to 1.7.2 . The root cause is a race condition where the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse a single Rails::HTML::PermitScrubber across calls without proper synchronization. In ...

CVE-2026-128068 rails-html-sanitizer: Possible regular expression denial of service with certain configurations

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

EUVD-2026-125592

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned...

CVE-2026-128068

The rails-html-sanitizer library (versions 1.0.3 through 1.7.1) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause lies in the Rails::HTML::PermitScrubber component, where a pattern used to check SVG href and xlink:href local references causes all-whitespace values t...

CVE-2026-86076-PoC

CVE-2026-86076 — n8n expression sandbox escape via class-field sanitizer rebinding Authenticated workflow-edit code execution in the n8n backend process. The expression compiler injects this.sanitizekey for every computed member access; a class field literally named sanitize re-binds that sanitiz...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...