ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

Summary When SVG animation is allowed, attributeName="href" makes values a list of URL destinations. sanitize-html accepts a list that starts with a safe fragment even when values is explicitly scheme-checked, allowing a later javascript: destination to execute when the sanitized link is activate...

CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371

ApostropheCMS (Node.js CMS) shipped a sanitize-html package vulnerable to stored XSS via SVG SMIL animation elements from version 1.9.0 through 2.17.7 . The root cause is in packages/sanitize-html/index.js, which validates the values attribute as a single flat URL, failing to account for SVG SMIL...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

UBUNTU-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

DEBIAN-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

CVE-2026-19032 affects jackson-databind , where the java.nio.file.Path deserializer (JDKFromStringDeserializer.NioPathHelper.deserialize) resolves an attacker-supplied URI without restricting its scheme. When Path.of(uri) throws FileSystemNotFoundException, the code enumerates ServiceLoader and c...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...

CVE-2026-59111

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

CVE-2026-59111

CVE-2026-59111 is an OS command injection vulnerability in the Digitální a informační agentura (DIA) eObčanka-Identifikace macOS application. Prior to version 3.6.0 , incoming URL parameters were passed to the compiled AppleScript wrapper via concatenation without sufficient sanitization, allowin...

EUVD-2026-68596

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...