WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload

The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Stored Cross-Site Scripting via arbitrary URL injection in versions up to and including 6.1 and 1.0 respectively. Authenticated users with author-level permissions can inject arbitrary remote URLs for SVG map files. When a user...

Astra Linux – Vulnerability in ruby-loofah

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built upon the Nokogiri framework. Loofah 2.19.1 contains a inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lea...

Astra Linux – Vulnerability in Batik

A vulnerability in Batik of Apache XML Graphics allows an attacker to execute untrusted Java code from an SVG. This issue affects Apache XML Graphics versions prior to 1.16. It is recommended to update to version 1.16...

Astra Linux – Vulnerability in WebKit2GTK

A use-after-free vulnerability exists in the SVG implementation in Blink, as used in Google Chrome before version 35.0.1916.114. This vulnerability allows remote attackers to cause a denial of service or potentially cause unspecified other impacts through vectors that trigger the removal of an...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick. This security flaw manifests as undefined behaviors when using double to type as sizet in svg, mvg, and other code segments reoccurring bugs of CVE-2022-32546...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick, where a specially created SVG file can load itself and cause a segmentation fault. This flaw allows a remote attacker to upload a specially crafted SVG file, leading to a segmentation fault and the creation of numerous trash files in "/tmp," resultin...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file could lead to a DoS attack. Version 7.1.2-12 addresses this issue...

CVE-2026-72594

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594

CVE-2026-72594 affects lobehub/lobe-chat up to v2.2.13. The vulnerability is a stored XSS where a low-privileged authenticated user can inject arbitrary JavaScript by uploading a crafted SVG as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the...

CVE-2026-16559

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

CVE-2026-16559

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

EUVD-2026-54734

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

Mermaid allows CSS injection applying to sibling elements of the diagram

Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with mermaid-X, sibling and + combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram . Most users of mermaid would not be affected by this...

EulerOS 2.0 SP15 : emacs (EulerOS-SA-2026-2881)

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector...

CVE-2026-16573

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

CVE-2026-16583

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:3441-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3441-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing...

EUVD-2026-52170

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

EUVD-2026-51622

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

GHSA-45QG-252V-3F7P Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

A element placed directly inside an or MathML container was not removed by Jodit's clean-html sanitizer. The deny/allow tag filter compared node.nodeName against an upper-cased tag hash, but foreign SVG/MathML elements preserve their original-case node names — an SVG script reports "script", not...