Scalable Vector Grief
2026-11-02T20:51:48Z•a8cf7cae3bbdbc32483cfda9c08011d1a51004b1ccd1a0a36b23685999140bd2
CSS-injectionHTTP-desyncJWTSAML-authentication-bypassSSRFSVG-sanitization-bypassURL-validation-bypassWAF-bypassXSSbrowser-securitycache-poisoningcookie-securityparser-discrepancyrequest-smugglingsecurity-researchtoken-forgeryweb-application-securityweb-security
What happened
PortSwigger Research feed containing recent web security research on SVG and CSS sanitizer bypasses, JavaScript execution, HTTP request smuggling and desynchronization, SAML authentication bypasses, cookie and WAF bypasses, URL validation flaws, cache poisoning, parser discrepancies, XSS, timing attacks, token forgery, and security testing tooling. The most prominent item describes bypassing six of eight SVG sanitizers and achieving JavaScript execution in Firefox through response-header behavior despite a harmless XML body.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- a8cf7cae3bbdbc32483cfda9c08011d1a51004b1ccd1a0a36b23685999140bd2
- Enrichment time
- 2026-11-02T20:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.