https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:26:24.167440+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1256 certfr-2026-avi-1256 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T23:26:24.174313+00:00 certfr-2026-avi-1256 https://cve.radiocsirt.org/vuln/euvd-2026-355121 EUVD-2026-355121 2026-10-03T23:26:24.174370+00:00 EUVD-2026-355121 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63670 fkie_cve-2026-63670 2026-10-03T23:26:24.174395+00:00

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

 https://cve.radiocsirt.org/vuln/ghsa-jxwj-j7wr-gfrw GHSA-jxwj-j7wr-gfrw — ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close 2026-10-03T23:26:24.174442+00:00

Affected: npm: sanitize-html

### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input containing a literal `</textarea/>` (a solidus right after the RCDATA end-tag name) lets non-allowed markup such as `<img src=x onerror=…>` pass through `sanitizeHtml()` **live and unescaped**, even though `img`/`onerror` are not in the allowlist. A spec-compliant browser executes the surviving handler — XSS. This is a literal-solidus variant that bypasses the two most recent fixes in this code area (CVE-2026-40186, CVE-2026-44990), both already applied in 2.17.5. The default configuration is not affected.

### Details `sanitize-html` emits the text content of HTML raw-text elements (`textarea`, `xmp`) without escaping. Two things combine: - **Parser differential:** on input, htmlparser2 does NOT recognize `</textarea/>` (solidus after the RCDATA end-tag name) as a close tag; it emits `</textarea/><img …>` as a single raw-text node. - **Unescaped passthrough:** the `ontext` handler (`index.js` ~575-583) appends `textarea`/`xmp` content with `result += text` (no `escapeHtml`), assuming it is "already properly encoded" — true for entity-decoded content (what CVE-2026-40186 fixed) but false for this mis-tokenized literal close tag. A spec browser treats `</textarea/>` as a valid `textarea` close, so the following `<img onerror>` is parsed as a live element. The recent fixes addressed entity-encoding (CVE-2026-40186) and the `xmp` default (CVE-2026-44990); neith…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596 WID-SEC-W-2026-3596 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-03T23:26:24.174526+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.