https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T04:34:20.638066+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349633 EUVD-2026-349633 2026-10-17T04:34:20.640913+00:00 EUVD-2026-349633 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71236 fkie_cve-2026-71236 2026-10-17T04:34:20.640944+00:00

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

 https://cve.radiocsirt.org/vuln/ghsa-c924-wcfj-cr8j GHSA-c924-wcfj-cr8j 2026-10-17T04:34:20.640975+00:00

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification. This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to neutralize them, re-introducing stored XSS across API-writable fields (products, recipes, stock, users, chores, and others) that are rendered elsewhere without re-sanitization.