EUVD-2026-68403

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838

Venueless 's default Docker image had a vulnerability where uploaded SVG files could be served with executable JavaScript content, potentially allowing stored XSS. The root cause was the absence of a proper Content Security Policy (CSP) in the image's default configuration. The fix sets a valid C...

EUVD-2026-68392

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82868: Improper Neutralization of Input During Web Page Generation

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82838: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data and influence the integrity of the data.

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the lack of protective measures for the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a special...

The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...

PT-2026-83784

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

PT-2026-83718

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82880: Improper Restriction of XML External Entity Reference

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...

Unity Linux 20.1070e Security Update: python-lxml (UTSA-2026-104952)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104952 advisory. lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can ...

Snipe-IT vulnerable to stored XSS via inline-served attachment

Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...

EUVD-2026-42996

Snipe-IT vulnerable to stored XSS via inline-served attachment...

Chromium: CVE-2026-79016 Observable discrepancy in SVG

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability

Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...