Medium
CVE-2026-113650
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 20
Reset filters
Medium
CVE-2026-113661
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
Low
CVE-2026-113657
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
A namespace prefix bypass in sanitize-html allows SVG SMIL animation elements to evade URL sink restrictions, potentially enabling cross-site scripting attacks when SVG elements are allowed.
Medium
CVE-2026-113654
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
In sanitize-html prior to 2.18.0, an implied close within elements such as <noscript> causes discard regions to end early, allowing raw text content to be erroneously rendered as regular HTML elements.
Medium
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Medium
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Medium
CVE-2026-53606
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes
Critical
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Medium
CVE-2026-40186
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
High
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
Medium
CVE-2026-56356
n8n has XSS in Chat Trigger Node through Custom CSS
High
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Medium
CVE-2019-25225
sanitize-html is vulnerable to XSS through incomprehensive sanitization
Medium
CVE-2024-21501
sanitize-html Information Exposure vulnerability
High
CVE-2022-25887
Sanitize-html Vulnerable To REDoS Attacks
Medium
CVE-2021-26540
Improper Input Validation in sanitize-html
Medium
CVE-2021-26539
Improper Input Validation in sanitize-html
Medium
CVE-2016-1000237
Cross-Site Scripting in sanitize-html
Medium
CVE-2017-16016
Cross-Site Scripting in sanitize-html
Medium
CVE-2017-16017
Cross-Site Scripting in sanitize-html
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.