svg svgo

• CVE-2026-84370 High 8.2 SVGO: removeScripts allows executable links through namespace and control-character bypasses 0.5%
• CVE-2026-84369 Medium 6.1 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements 0.4%
• CVE-2026-73650 High 8.2 SVGO: removeScripts plugin leaves some executable scripts intact 0.4%
• CVE-2026-29074 High 7.5 SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) 0.7%