https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:29:39 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0523 certfr-2026-avi-0523 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0523 https://cve.radiocsirt.org/vuln/cleanstart-2026-lc05413 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-lc05413 https://cve.radiocsirt.org/vuln/euvd-2026-277443 EUVD-2026-277443 https://cve.radiocsirt.org/vuln/euvd-2026-277443 https://cve.radiocsirt.org/vuln/fkie_cve-2026-0540 <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like &lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt; in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like &lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt; in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-0540 https://cve.radiocsirt.org/vuln/ghsa-v2wj-7wpq-c8vv <p><strong>Affected:</strong> npm: dompurify</p> <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `&lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt;` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> <p><strong>Affected:</strong> npm: dompurify</p> <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `&lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt;` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> https://cve.radiocsirt.org/vuln/ghsa-v2wj-7wpq-c8vv https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-0540 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:25.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like &lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt; in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:25.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like &lt;/noscript&gt;&lt;img src=x onerror=alert(1)&gt; in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-0540 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1007 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1007