https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:49:13.828611+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2018-8048 CVE-2018-8048 2026-10-04T18:49:13.864866+00:00

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

 https://cve.radiocsirt.org/vuln/ghsa-x7rv-cr6v-4vm4 GHSA-x7rv-cr6v-4vm4 — Cross-site Scripting in loofah 2026-10-04T18:49:13.864939+00:00

Affected: RubyGems: loofah, RubyGems: nokogiri

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX, * in combination with libxml2 >= 2.9.2.

JRuby users are not affected.