https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:36:19.594488+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-00589 bdu:2024-00589 2026-10-03T23:36:19.624689+00:00 bdu:2024-00589 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0049 certfr-2024-avi-0049 — De multiples vulnérabilités ont été découvertes dans Oracle Weblogic Server. Certaines d'entre elles permettent à un at… 2026-10-03T23:36:19.624730+00:00 certfr-2024-avi-0049 https://cve.radiocsirt.org/vuln/euvd-2026-186618 EUVD-2026-186618 2026-10-03T23:36:19.624750+00:00 EUVD-2026-186618 https://cve.radiocsirt.org/vuln/fkie_cve-2023-43643 fkie_cve-2023-43643 2026-10-03T23:36:19.624762+00:00

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

 https://cve.radiocsirt.org/vuln/ghsa-pcf2-gh6g-h5r2 GHSA-pcf2-gh6g-h5r2 — mXSS in AntiSamy 2026-10-03T23:36:19.624795+00:00

Affected: Maven: org.owasp.antisamy:antisamy

# Impact

There is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output.

# Patches

Patched in AntiSamy 1.7.4 and later. See important remediation details in the reference given below.

# Workarounds

If you cannot upgrade to a fixed version of the library, the following mitigation can be applied until you can upgrade: Manually edit your AntiSamy policy file (e.g., antisamy.xml) by deleting the `preserveComments` directive or setting its value to `false`, if present. Also it would be useful to make AntiSamy remove the `noscript` tag by adding this in your tag definitions under the `<tagrules>` node (or deleting it entirely if present): ```xml <tag name="noscript" action="remove"/> ```

As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing them as recommended should be sufficient to protect you against this vulnerability when using a vulnerable version of this library. However, the existing bug would still be present in AntiSamy or its parser dependency (neko-htmlunit). The safety of this workaround relies on configurations that may change in the future and don't address…

 https://cve.radiocsirt.org/vuln/gsd-2023-43643 gsd-2023-43643 2026-10-03T23:36:19.624841+00:00 gsd-2023-43643 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-43643 UBUNTU-CVE-2023-43643 2026-10-03T23:36:19.624855+00:00

Affected: Ubuntu:16.04:LTS: libowasp-antisamy-java, Ubuntu:18.04:LTS: libowasp-antisamy-java, Ubuntu:20.04:LTS: libowasp-antisamy-java, Ubuntu:22.04:LTS: libowasp-antisamy-java, Ubuntu:24.04:LTS: libowasp-antisamy-java, Ubuntu:25.10: libowasp-antisamy-java, Ubuntu:26.04:LTS: libowasp-antisamy-java

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0123 WID-SEC-W-2024-0123 — Oracle Fusion Middleware: Mehrere Schwachstellen 2026-10-03T23:36:19.624889+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.