Get real-time updates on Telegram
CVE-2026-103686
CVE-2026-103686. CVSS base score 3.5 (LOW, Vendor/CNA). EPSS 0.00365 (percentile 0.27994), scored 2026-10-04.
Affected technology
dom-sanitizer · 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15
rhukster
Description’s affected range: up to 1.0.15
Component: URL Validation
Function: DOMSanitizer::isDangerousUrl
File: src/DOMSanitizer.php
Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction
What an attacker can do
VulDB’s CVSS 4.0 assessment rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.
Patch identifier: 4623b565d060bc02ca5a07d8c8241fe28e2edfda
- CWE
- CWE-79, CWE-94
- CCR priority
- 14.1 /100 (P5)
- CVSS
- 3.5 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N · Vendor/CNA
- EPSS
- 0.00365 · percentile 0.27994 · 2026-10-04
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-06 03:43:23.555804+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-103686.html