https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:44:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-376220 EUVD-2026-376220 https://cve.radiocsirt.org/vuln/euvd-2026-376220 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18320 <p>Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., &#39;onload&#39;, &#39;onerror&#39;). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).</p> <p>Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., &#39;onload&#39;, &#39;onerror&#39;). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18320 https://cve.radiocsirt.org/vuln/ghsa-v29r-35gc-f5pr <p>Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., &#39;onload&#39;, &#39;onerror&#39;). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).</p> <p>Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., &#39;onload&#39;, &#39;onerror&#39;). An attacker could supply a document containing malicious SVG content that survives sanitization and executes script wher rendered in the Reader WebView, resulting in client-side cross-site scripting (XSS).</p> https://cve.radiocsirt.org/vuln/ghsa-v29r-35gc-f5pr