https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:45:16.969135+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10872 bdu:2026-10872 2026-10-03T14:45:17.039444+00:00 bdu:2026-10872 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0917 certfr-2026-avi-0917 — De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Elles permettent à un attaquant de provoquer un… 2026-10-03T14:45:17.039489+00:00 certfr-2026-avi-0917 https://cve.radiocsirt.org/vuln/cleanstart-2026-fr63847 Withdrawn: CLEANSTART-2026-FR63847 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-03T14:45:17.039508+00:00

Withdrawn by the publisher.

Affected: CleanStart: elasticsearch

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-261937 EUVD-2026-261937 2026-10-03T14:45:17.039539+00:00 EUVD-2026-261937 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66021 fkie_cve-2025-66021 2026-10-03T14:45:17.039551+00:00

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.

 https://cve.radiocsirt.org/vuln/ghsa-g9gq-3pfx-2gw2 GHSA-g9gq-3pfx-2gw2 — OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization 2026-10-03T14:45:17.039575+00:00

Affected: Maven: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

### Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy.

### Details

The OWASP java HTML sanitizer is vulnerable to XSS. This only happens when HtmlPolicyBuilder allows `noscript` & `style` tag with `allowTextIn` inside style tags.

The following condition is very edge case but if users combine a HtmlPolicyBuilder with any other tags except `noscript` and allow `style` tag with `allowTextIn` inside the style tag then In this case sanitizer would be safe from XSS. This happens because how the browser also perceives `noscript` tags post sanitization.

### PoC

1. Lets create a `HtmlPolicyBuilder` which allows `p, noscript, style` html tags and allows `.allowTextIn("style")`. 2. There are two XSS payloads which very identical and only difference is one has p tag and other has noscript tag. These payload have script tags that could be vulnerable to XSS and should be stripped out after sanitisation.

```HTML 1. <noscript><style></noscript><script>alert(1)</script> 2. <p><style></p><script>alert(1)</script> ```

3. Run the following piece of code which sanitizes the payload.

```java public class main { private static final String ALLOWED_HTML_TAGS = "p, noscript, style";

/** * Description of vulnerabil…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0438 WID-SEC-W-2026-0438 — Atlassian Bamboo und Confluence (Data Center und Server): Mehrere Schwachstellen 2026-10-03T14:45:17.039630+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo und Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.