rrrene html_sanitize_ex

• CVE-2026-68750 High 8.2 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service 0.8%
• CVE-2026-68749 High 8.2 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service 0.8%
• CVE-2026-68747 Low 2.3 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input 0.4%
• CVE-2026-66829 Low 2.3 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection 0.6%
• CVE-2026-66370 Medium 4.8 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking 0.4%
• CVE-2026-66843 Low 2.3 html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding 0.5%