Login Request a demo
LO
Product
loofah
by flavorjones · last CVE Aug 12, 2026
6
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 2Medium 2Low 2
Severity
All severities6Critical0High2Medium2Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add loofah to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-23516
7.5
1%
Dec 14
Uncontrolled Recursion in Loofah
Affected: >= 2.2.0, < 2.19.1
CVE-2022-23514
7.5
2%
Dec 14
Inefficient Regular Expression Complexity in Loofah
Affected: < 2.19.1
CVE-2022-23515
6.1
1%
Dec 14
Improper neutralization of data URIs may allow XSS in Loofah
Affected: >= 2.1.0, < 2.19.1
CVE-2026-73490
4.7
0%
Aug 12
Loofah: SVG `href` attribute bypasses local-reference restriction
Affected: < 2.25.2
CVE-2026-73492
2.3
0%
Aug 12
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Affected: >= 2.25.0, < 2.25.2
CVE-2026-73491
2.3
0%
Aug 12
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Affected: >= 2.25.0, < 2.25.2
Showing 6