roninforge-angularjs-migration

roninforge-angularjs-migration Source-of-truth repo for the AngularJS to Angular 18 GitHub Copilot instructions package shipped to github/awesome-copilot at instructions/angularjs-to-angular-18.instructions.md. First in a planned series of enterprise-targeted Copilot products from RoninForge...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-56735

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735

The open source helpdesk system Zammad is vulnerable to an oversight in its HTML sanitizer (HtmlSanitizer::Strict ). Prior to versions 7.0.2 and 7.1.0 , the sanitizer blocked external URLs in tags but failed to apply the same check to the srcset attribute. An attacker can bypass external content...

EUVD-2026-87215

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735 Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

CVE-2026-56735: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, zammad's HTML sanitizer HtmlSanitizer::Strict blocks external URLs in to prevent remote content loading, but the srcset attribute, also allowlisted for , is not subject to the same check. This oversight...

PT-2026-98949

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Zammad versions prior to 7.1.0 Description The HTML sanitizer HtmlSanitizer::Strict fails to block external URLs within the srcset attribute of tags. While other external URLs are blocked to prevent remote conten...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829

The Optimole WordPress plugin (versions 4.2.3-4.2.11 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly escape user-supplied values when building an image tag attribute. Specifically, the flaw involves the srcset descriptor parameter , which allows unauthenticated u...

K000162342: Angular JS vulnerabilities CVE-2024-8372, CVE-2024-8373, CVE-2024-21490, CVE-2025-0716

Security Advisory Description CVE-2024-8372 Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing . This issue...

Exploit for CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary...

CVE-2026-5217

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's'...

WordPress Optimole plugin <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin Optimole versions = 4.2.2...

EUVD-2026-21662

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's'...

CVE-2026-5217

The CVE covers the WordPress plugin Optimole (versions up to 4.2.2). It is vulnerable to an unauthenticated stored XSS via the srcset descriptor parameter (s) in the REST endpoint /wp-json/optimole/v1/optimizations. Root cause: insufficient input sanitization and output escaping, where sanitize_t...

CVE-2026-5217 Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's'...