CVE-2026-28348 lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters,...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28348 Source advisory: MEND:CVE-2026-28348...

CVE-2026-28348 lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters,...

CVE-2026-27376: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through = 2.2.7...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005464)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005464 advisory. In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix napiskbcacheput warning After the commit bdacf3e34945 net: Use nested-BH locking f...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28350 Source advisory: GHSA-XVP8-3MHV-424C...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28350 Source advisory: OSV:GHSA-XVP8-3MHV-424C...

lxml-html-clean has <base> tag injection through default Cleaner configuration

Summary The tag passes through the default Cleaner configuration. While pagestructure=True removes html, head, and title tags, there is no specific handling for , allowing an attacker to inject it and hijack relative links on the page. Details The tag is not currently in the pagestructure kill se...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28350 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28350 Source advisory: SNYK:PYTHON-LXMLHTMLCLEAN-15369131...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28348 Source advisory: GHSA-HW26-MMPG-FQFG...

Improper Encoding or Escaping of Output

Overview lxml-html-clean is a HTML cleaner from lxml project Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the hassneakyjavascript function. An attacker can cause external CSS to be loaded or execute scripts in certain browsers by injecting special...

lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

Summary The hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters, allowing external CSS loading or XSS in older browsers. Details The root cause is located in clean.py around...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28348 Source advisory: OSV:GHSA-HW26-MMPG-FQFG...

ailingo (>=0.2.0, <=0.4.0), async-scrape (>=0.1.19, <=0.1.20) +27 more potentially affected by CVE-2026-28348 via lxml-html-clean (>=0.1.0, <=0.4.3)

lxml-html-clean PYPI version =0.1.0, =0.2.0, =0.1.19, =0.0.550, =0.1.0, =0.0.7, =0.2.0, =2.2.16, =0.9.0, =0.6.0, =0.2.0, =12.0.15, =1.0.1a4, =1.0.1a5 and more Source cves: CVE-2026-28348 Source advisory: SNYK:PYTHON-LXMLHTMLCLEAN-15369490...

PT-2026-22989

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.4 Description The has sneaky javascript method in lxml html clean incorrectly strips backslashes before checking for dangerous CSS keywords. This allows CSS Unicode escape sequences to bypass the @import a...

PT-2026-22701

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.4 Description The software does not properly handle the tag during HTML cleaning. Specifically, the tag is not removed even when page structure=True, which removes html, head, and title tags. This allows a...

AI Under Control: Link11 Launches AI Management Dashboard for Clean Traffic

Frankfurt am Main, Germany, 19th February 2026, CyberNewswire...

CVE-2026-2284

The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.8. This is due to a missing capability check and nonce verification on the 'necleandata' AJAX action. This makes it possible for authenticated attackers,...

PT-2026-20504

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.17.11 GitHub Enterprise Server versions prior to 3.18.5 GitHub Enterprise Server versions prior to 3.19.2 Description An authorization flaw exists in GitHub Enterprise Server that could allow an...

CVE-2026-23136

CVE-2026-23136 : Linux kernel vulnerability in the libceph OSD client where the sparse-read state isn’t reset after a mid-payload disruption, causing the client to treat a fresh reply as a continuation of the old one. This can lead to a denial of service condition due to persistent sparse-read st...