CVE-2026-128028

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list...

EUVD-2026-125074

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in MageCatalogModelProductOptionTypeFile, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list...

CVE-2026-88987 - XSS via XHTML data URI

More info at https://www.silverstripe.org/download/security-releases/cve-2026-88987...

Linux Distros Unpatched Vulnerability : CVE-2026-116802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

SUSE CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS. When configured to parse Extensible Hypertext Markup Language XHTML content, the library fails to properly normalize and sanitize attribute names within animation elements. An attacker...

EUVD-2026-110510

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

DEBIAN-CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

UBUNTU-CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

Cure53 DOMPurify cross-site scripting vulnerability

Versions of Cure53 DOMPurify prior to 3.4.17 contain a cross-site scripting vulnerability. This flaw arises because when PARSERMEDIATYPE is set to application/xhtml+xml, transformCaseFunc fails to convert attribute names to lowercase. Attackers can exploit this by using SVG files containing anima...

CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitizeAttributes function when PARSERMEDIATYPE is set to application/xhtml+xml. In XHTML mode, transformCaseFunc is the...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116802

Versions of DOMPurify prior to 3.4.17 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is that transformCaseFunc fails to lowercase attribute names, allowing attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is set to application/xhtml+xml. E...

CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sanitizeAttributes function when PARSERMEDIATYPE is set to application/xhtml+xml. In XHTML mode, transformCaseFunc is the identity function...

PT-2026-125508

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER MEDIA TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...