CVE-2026-71497

MediumCVSS 4.7/10Last modified Oct 24, 2026

Description

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-714985.1node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated CVE-2026-71506.3A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_faCVE-2026-715025.1CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiteCVE-2026-715036.1Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type reCVE-2026-715048.1Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creatCVE-2026-715057.1Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes thatCVE-2026-715068.1Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated aCVE-2026-715076.5Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allCVE-2026-715086.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with userCVE-2026-715096.5Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticCVE-2026-71518.8A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipuCVE-2026-715106.5Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read right
CVE-2026-71497: Medium severity, CVSS 4.7 | Vulnix