bluemonday

bluemonday bluemonday は Go で実装された HTML サニタイザーです。高速で、高度に設定可能です。 bluemonday は、信頼できないユーザー生成コンテンツを入力として受け取り、承認された HTML 要素と属性の許可リストに基づいてサニタイズされた HTML を返すため、そのコンテンツを Web ページに安全に含めることができます。 ユーザー生成コンテンツを受け入れており、サーバーが Go を使用しているなら、bluemonday が必要です 。 ユーザー生成コンテンツのデフォルトポリシー（bluemonday.UGCPolicy.Sanitize）は、これ...

owasp-java-encoder

OWASP Java Encoder Project Contextual Output Encoding is a computer programming technique necessary to stop Cross-Site Scripting. This project is a Java 8+ simple-to-use drop-in high-performance encoder class with little baggage. For more detailed documentation on the OWASP Java Encoder please...

CLSA-2026-1786636721 TuxCare security update for dompurify (14 CVEs)

TuxCare rebuilt dompurify to address 14 CVEs. Fixed in 2.4.7-tuxcare.1...

CVE-2026-47344

When ALLOWINSECURERAWTEXT is enabled, whitespace-variant closing tags e.g., are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitiz...

CLSA-2026-1778670534 php: Fix of CVE-2026-6735

CVE-2026-6735: HTML-encode proc.requesturi and tighten querystring entity flags in sapi/fpm/fpm/fpmstatus.c to fix XSS in PHP-FPM status endpoint...

OESA-2026-1977 golang security update

. Security Fixes: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVE-2026-25679 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the valu...

UBUNTU-CVE-2026-33170

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, SafeBuffer% does not propagate the @htmlunsafe flag to the newly created buffer. If a SafeBuffer is mutated in place e.g. via gsub! and th...

CVE-2026-27142

A vulnerability in Go (specifically involving the cmd/compile or general runtime behavior depending on context) allows for Cross-Site Scripting (XSS) because URLs inserted into the content attribute of HTML meta tags are not correctly escaped. This occurs specifically when the meta tag also conta...

CVE-2025-40891

The CVE-2025-40891 issue affects Nozomi Networks Guardian/CMC Time Machine Snapshot Diff functionality. An unauthenticated attacker can send crafted network packets at two different times to inject HTML into asset attributes across two snapshots. When a user interacts with the affected snapshots ...

EUVD-2021-1222

Malware in sbrugna...

EUVD-2017-0312

Malware in sbrugna...

EUVD-2022-38613

Malicious code in bioql PyPI...

EUVD-2022-1356

Malicious code in bioql PyPI...

EUVD-2022-15853

Malicious code in bioql PyPI...

CVE-2023-22461

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal...

CVE-2022-4898

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was take...

carnicasmulas.com Cross Site Scripting vulnerability OBB-4049104

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

medicine.karazin.ua Cross Site Scripting vulnerability OBB-4049079

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

manuall.cz Cross Site Scripting vulnerability OBB-4048836

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

krucemburk.shm.cz Cross Site Scripting vulnerability OBB-4047889

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...