CVE-2026-105950

A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.

• CWE-79
• CWE-94

• https://github.com/getformwork/formwork/
• https://github.com/getformwork/formwork/commit/729701e59c5886685c5a1d477bdc3035e41f18b1
• https://github.com/getformwork/formwork/pull/940
• https://github.com/getformwork/formwork/releases/tag/2.3.13
• https://github.com/getformwork/formwork/security/advisories/GHSA-p78q-v3pr-p87j
• https://vuldb.com/cve/CVE-2026-105950
• https://vuldb.com/submit/992820
• https://vuldb.com/vuln/413925
• https://vuldb.com/vuln/413925/cti

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105920A vulnerability was determined in Kusalkasilva Learning-Mana…7.3
• CVE-2026-105921A vulnerability was identified in Kusalkasilva Learning-Mana…6.3
• CVE-2026-105922A security flaw has been discovered in vllm-project vLLM up …4.3
• CVE-2026-10593The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unic…6.5
• CVE-2026-10594Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10595A path traversal vulnerability exists in parisneo/lollms ver…7.5
• CVE-2026-105957A vulnerability was detected in SourceCodester Performance I…6.3
• CVE-2026-10597OMICARD EDM developed by ITPison has a Insecure Direct Objec…6.9
• CVE-2026-105985Craft CMS 5.10.13.2 contains an authenticated remote code ex…8.8
• CVE-2026-10599The Integrate PhonePe with WooCommerce WordPress plugin thro…7.5
• CVE-2026-1060The WP Adminify plugin for WordPress is vulnerable to Sensit…5.3
• CVE-2026-10600Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6…4.3