CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-8630

justhtml versions ≤ 1.11.0 contain a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements (, [removed]). When sanitize_dom() is invoked with a custom policy that retains these elements, text nodes inside them are serialized without escaping, allowing an attacker to inject a...

EUVD-2026-64660

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

CVE-2026-41846

CVE-2026-41846...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-69237

Esri Portal for ArcGIS versions 11.3 and prior contain an HTML injection vulnerability in an administrative API . A remote attacker with administrative privileges can insert arbitrary HTML into the API. The CVSS 3.1 score is 3.8 (LOW) , reflecting the high privilege requirement (PR:H) and limited...

EUVD-2026-64085

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

EUVD-2026-64157

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

CVE-2026-69229

Esri Portal for ArcGIS versions 12.0 and prior are affected by an HTML injection vulnerability in the Portal for ArcGIS Home application. A remote, authenticated attacker can insert arbitrary HTML into the application, resulting in low confidentiality and integrity impact (CVSS 3.1: 5.4 MEDIUM )....

EUVD-2026-64153

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69238

Esri Portal for ArcGIS versions 11.5 and prior are affected by an HTML injection vulnerability in the Portal for ArcGIS Home application . A remote, highly privileged attacker can insert arbitrary HTML into the application. The CVSS 3.1 score is 3.5 (LOW) , reflecting the high privilege requireme...

EUVD-2026-64132

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...