jhy CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jhy CVE published 2026-08-06

CVE-2026-71497

This debrief provides an analysis of CVE-2026-71497, a vulnerability in the jsoup Java library used for parsing HTML. The vulnerability could allow for cross-site scripting (XSS) under certain conditions when using custom Safelists. The issue arises from the incorrect handling of malformed tag names ending in control characters, causing the tag to be parsed as a different element. This can result in inert [truncated]