CVE-2026-103687High· 7.3▾ MidnightPoC availableA vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is po…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103686Low· 3.5A flaw has been found in rhukster dom-sanitizer up to 1.0.15
CVE-2026-100370Medium· 4.7DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+
CVE-2026-116339High· 7.3iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist
CVE-2026-90808Medium· 6.3A vulnerability was determined in HKUDS nanobot up to 0.2.1
CVE-2026-113605High· 7.2Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
CVE-2018-7489Critical· 9.8FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw