CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

Linux Distros Unpatched Vulnerability : CVE-2026-84371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until...

PT-2026-84835

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

CVE-2026-77124: Incomplete List of Disallowed Inputs

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SVG SMIL animation handling in packages/sanitize-html/index.js. An attacker can execute JavaScript in the application’s origin by supplying an allowed or element with attributeName="href" or xlink:href"...

CVE-2026-84369

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-73781

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's...

EUVD-2026-69654

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-84370

SVGO (SVG Optimizer), a popular Node.js library for optimizing SVG files, contains a flaw in its opt-in removeScripts plugin (named removeScriptElement in v2/v3) that allows executable links to bypass filtering. The root cause involves two bypass vectors: the plugin fails to recognize namespace-p...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

EUVD-2026-69652

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84369

SVGO (SVG Optimizer), a Node.js library and CLI for optimizing SVG files, contains a sanitization gap in its opt-in removeScripts plugin (v1.0.0 through 2.8.3 / 3.3.4 / 4.0.x). The plugin removes SVG and XHTML [removed] elements but does not inspect executable HTML content inside SVG foreignObjec...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes...

CVE-2026-73781 Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's...

CVE-2026-73781

HPE AOS-CX web-based management interface contains a stored cross-site scripting (XSS) vulnerability. An authenticated remote attacker can inject malicious script that executes in the browser of an administrative user who interacts with the affected interface, enabling arbitrary script execution ...