https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T01:39:58.237984+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-31924 cnvd-2021-31924 2026-10-10T01:39:58.241540+00:00 cnvd-2021-31924 https://cve.radiocsirt.org/vuln/euvd-2026-25671 EUVD-2026-25671 2026-10-10T01:39:58.241572+00:00 EUVD-2026-25671 https://cve.radiocsirt.org/vuln/fkie_cve-2021-27671 fkie_cve-2021-27671 2026-10-10T01:39:58.241587+00:00

An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.

 https://cve.radiocsirt.org/vuln/ghsa-xmr7-v725-2jjr GHSA-xmr7-v725-2jjr — Cross site scripting in comrak 2026-10-10T01:39:58.241615+00:00

Affected: crates.io: comrak

An issue was discovered in the comrak crate before 0.9.1 for Rust. Cross site scripting (XSS) can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.

 https://cve.radiocsirt.org/vuln/gsd-2021-27671 gsd-2021-27671 2026-10-10T01:39:58.241637+00:00 gsd-2021-27671 https://cve.radiocsirt.org/vuln/rustsec-2021-0026 RUSTSEC-2021-0026 — XSS in `comrak` 2026-10-10T01:39:58.241648+00:00

Affected: crates.io: comrak

The [comrak](https://github.com/kivikakk/comrak) we were matching unsafe URL prefixes, such as `data:` or `javascript:` , in a case-sensitive manner. This meant prefixes like `Data:` were untouched.