flavorjones loofah

• CVE-2026-73492 Low 2.3 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons 0.4%
• CVE-2026-73491 Low 2.3 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references 0.4%
• CVE-2026-73490 Medium 4.7 Loofah: SVG `href` attribute bypasses local-reference restriction 0.3%
• CVE-2022-23516 High 7.5 Uncontrolled Recursion in Loofah 1.2%
• CVE-2022-23515 Medium 6.1 Improper neutralization of data URIs may allow XSS in Loofah 0.9%
• CVE-2022-23514 High 7.5 Inefficient Regular Expression Complexity in Loofah 1.8%