Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configu

历史摘要 · 未重新核验 · GitHub Advisory

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` or `vbscript:` URIs when the sch

历史摘要 · 未重新核验 · GitHub Advisory

Loofah: SVG `href` attribute bypasses local-reference restriction

## Summary Loofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-d

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50276

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

ViewComponent: Reused Component Instances Retain Stale Render Context

CVE-2026-54497

# Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple re

历史摘要 · 未重新核验 · GitHub Advisory

ViewComponent: around_render HTML-Safety Bypass

CVE-2026-54498

## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied

历史摘要 · 未重新核验 · GitHub Advisory

websocket-driver: Memory exhaustion in HTTP header parser

CVE-2026-54465

### Impact If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server o

历史摘要 · 未重新核验 · GitHub Advisory

websocket-driver: Resource limit bypass via message compression

CVE-2026-54464

### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can

历史摘要 · 未重新核验 · GitHub Advisory

websocket-driver: Memory exhaustion via abuse of protocol length headers

CVE-2026-54463

### Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitra

历史摘要 · 未重新核验 · GitHub Advisory

Decidim: Push subscriptions can be abused for server-side requests

CVE-2026-45573

## Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send pat

历史摘要 · 未重新核验 · GitHub Advisory

Decidim: HTML content blocks allow stored script execution

CVE-2026-45572

## Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an

历史摘要 · 未重新核验 · GitHub Advisory

Decidim: CSV census record endpoints improper authorization

CVE-2026-45415

## Description A participant manager can access and modify the CSV census record admin forms. ## Technical description

历史摘要 · 未重新核验 · GitHub Advisory

Decidim: JWT-backed authentication can be replayed across organizations

CVE-2026-45414

## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `parti

历史摘要 · 未重新核验 · GitHub Advisory

Decidim: Verification documents can be downloaded through reusable links

CVE-2026-45378

## Description Scanned identity-document images provided by participants and shown in the verification admin workflow a

历史摘要 · 未重新核验 · GitHub Advisory

Excon does not redact additional sensitive/risky headers when following redirects

CVE-2026-54171

### Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitiv

历史摘要 · 未重新核验 · GitHub Advisory

Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

CVE-2026-54163

## Summary `secure_headers` builds the `Content-Security-Policy` value by stitching every configured directive together

历史摘要 · 未重新核验 · GitHub Advisory

Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

CVE-2026-53769

### Summary Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented

历史摘要 · 未重新核验 · GitHub Advisory

YARD static cache reads raw traversal paths before router sanitization

CVE-2026-49342

### Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is conf

历史摘要 · 未重新核验 · GitHub Advisory

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

CVE-2026-55518

## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource

历史摘要 · 未重新核验 · GitHub Advisory

Net::IMAP: Command Injection via ID command argument

CVE-2026-47242

### Summary Two `Net::IMAP` commands, `#id` and `#enable`, do not validate their arguments. Arguments to either comman

历史摘要 · 未重新核验 · GitHub Advisory