SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version
#cwe-79
共收录 5519 条相关情报。
← 返回所有主题league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
### Summary The `AttributesExtension` documents a security guarantee: > **Note:** Attributes starting with `on` (e.g.
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scriptin...
CVE-2026-73731
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated r
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting...
CVE-2026-73703
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated a
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site s...
CVE-2026-73700
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
CVE-2026-58191
## Summary Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html ...
CVE-2026-84232
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served wit
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and includi...
CVE-2026-7877
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-cal
Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowi...
CVE-2026-19471
Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is n
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descr...
CVE-2026-84193
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render un
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacke...
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and mplsVpnVrfRouteDistinguisher fields f...
CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device ...
CVE-2026-84189
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML esc...
CVE-2026-84188
LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs
LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
CVE-2026-84193
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render un
LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou
LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip
LibreNMS before 26.7.0 Stored XSS via Oxidized API
CVE-2026-84189
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable
librenms before 26.7.0 Stored XSS via graph_descr settings
CVE-2026-84188
LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to ins...
CVE-2026-19914
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' paramete