https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T09:40:08.827479+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71236 CVE-2026-71236 — Grocy - Stored XSS via HTMLPurifier Output Double-Decode 2026-10-17T09:40:08.828646+00:00

Affected: grocy

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.