https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:13:26.533254+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-258331 EUVD-2026-258331 2026-10-03T14:13:26.765670+00:00 EUVD-2026-258331 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23515 fkie_cve-2022-23515 2026-10-03T14:13:26.765711+00:00

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

 https://cve.radiocsirt.org/vuln/ghsa-228g-948r-83gx GHSA-228g-948r-83gx — Improper neutralization of data URIs may allow XSS in Loofah 2026-10-03T14:13:26.765745+00:00

Affected: RubyGems: loofah

## Summary

Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.

## Mitigation

Upgrade to Loofah `>= 2.19.1`.

## Severity

The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html) - [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266) - https://hackerone.com/reports/1694173 - https://github.com/flavorjones/loofah/issues/101

## Credit

This vulnerability was responsibly reported by Maciej Piechota (@haqpl).

 https://cve.radiocsirt.org/vuln/gsd-2022-23515 gsd-2022-23515 2026-10-03T14:13:26.765783+00:00 gsd-2022-23515 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12768-1 openSUSE-SU-2024:12768-1 — ruby3.1-rubygem-loofah-2.19.1-1.1 on GA media 2026-10-03T14:13:26.765796+00:00

ruby3.1-rubygem-loofah-2.19.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:2097 RHSA-2023:2097 — Red Hat Security Advisory: Satellite 6.13 Release 2026-10-03T14:13:26.765815+00:00

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaug…

 https://cve.radiocsirt.org/vuln/suse-su-2023:1657-1 SUSE-SU-2023:1657-1 — Security update for rubygem-loofah 2026-10-03T14:13:26.765878+00:00

Security update for rubygem-loofah

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23515 UBUNTU-CVE-2022-23515 2026-10-03T14:13:26.765895+00:00

Affected: Ubuntu:16.04:LTS: ruby-loofah, Ubuntu:18.04:LTS: ruby-loofah, Ubuntu:20.04:LTS: ruby-loofah, Ubuntu:22.04:LTS: ruby-loofah

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0266 WID-SEC-W-2023-0266 — genua genucenter: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2026-10-03T14:13:26.765919+00:00

Ein Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.