CVE-2026-76203
NoneCVSS
—
EPSS
—
Published
Aug 19, 2026
CISA due date
—
The record
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. CWE-180
- CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash… CWE-180
- CVE-2026-82481 The cohttp package before 6.3.0 for OCaml allows directory traversal. CWE-180
- CVE-2026-73420 NextAuth.js provides authentication for Next.js. CWE-180
- CVE-2026-69245 Guzzle is an extensible PHP HTTP client. CWE-180
- CVE-2026-69246 Guzzle is an extensible PHP HTTP client. CWE-180
- CVE-2026-62999 Copier is a library and CLI app for rendering project templates. CWE-180
- CVE-2026-7120 @fastify/static evaluates the allowedPath callback before normalizing dot segments and… CWE-180