CVE WATCH / VULNERABILITY DETAIL
CVE-2026-107381
MEDIUMCVSS 6.5NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrE
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-104939 HIGH 7.5
- CVE-2026-101019 MEDIUM 6.5
- CVE-2026-101025 MEDIUM 5.3
- CVE-2020-37282 CRITICAL 9.8
- CVE-2026-98417
- CVE-2026-98418
- CVE-2026-98419
- CVE-2026-98420
- CVE-2026-98409
- CVE-2026-98410