Skip to contentTypo3 Html-sanitizer vulnerabilities
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing DefenseCVE-2026-48760Fix available5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentCVE-2026-48761Fix available5.3 Medium
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)CVE-2026-45753Fix available2.1 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationCVE-2026-45066Fix available2.3 Low
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href SpoofingCVE-2026-45064Fix available2.3 Low
- matthiask html-sanitizerhtml-sanitizer allows arbitrary HTML present after sanitization because of unicode normalizationCVE-2024-34078Fix available6.1 Medium
- typo3 html-sanitizer, html sanitizer, typo3 +2 moreBy-passing Cross-Site Scripting Protection in HTML SanitizerCVE-2023-47125Public exploitFix available4.7 Medium
- typo3 html sanitizer, html-sanitizer +1 moreBy-passing Cross-Site Scripting Protection in HTML SanitizerCVE-2023-38500Fix available4.7 Medium
- typo3 html-sanitizer, html sanitizer +1 moreCross-Site Scripting Protection bypass in HTML SanitizerCVE-2022-23499Fix available6.1 Medium
- typo3 html-sanitizer, html sanitizer +1 moreBypass of Cross-Site Scripting Protection in typo3/html-sanitizerCVE-2022-36020Fix available6.1 Medium