bleach

====== Bleach NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. Bleach can also linkify text safely, applying filters th...

cangibrina

/ | | | | / | ' \ / | | ' | '| | ' \ / | | || | | | | | | | | | | | | | | | | | | \,|| ||, ||./|| ||| ||,| |/ Beta - v0.8.7 Dashboard Finder English Português English Dashboard Finder Cangibrina is a multi platform tool which aims to obtain the admin Dashboard of sites using brute-force over...

CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to local file disclosure in versions v2.45, v2.103 and earlier , and other v2.x releases. The root cause is the improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. Due to an ...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

CVE-2026-19912: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

EUVD-2017-0061

Malware in sbrugna...

EUVD-2017-0060

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2016-9910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of special...

Linux Distros Unpatched Vulnerability : CVE-2016-9909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of the less than...

SUSE CVE-2016-9909

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of the less than character in attribute values...

SUSE CVE-2016-9910

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9909 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9909 Source advisory: OSV:GHSA-V9V9-XFFQ-RWR4...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9909 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9909 Source advisory: GHSA-V9V9-XFFQ-RWR4...

GHSA-V9V9-XFFQ-RWR4 Improper Neutralization of Input During Web Page Generation in html5lib

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of the less than character in attribute values...

Improper Neutralization of Input During Web Page Generation in html5lib

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of the less than character in attribute values...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9910 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9910 Source advisory: OSV:GHSA-8F6M-GFQ9-G33V...

Cross-site Scripting in html5lib

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting XSS attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909...

asc (>=0.1.0, <=0.3.1), bleach (1.5.0) +49 more potentially affected by CVE-2016-9910 via html5lib (>=0.95.0, <=0.9999999.0)

html5lib PYPI version =0.95.0, =0.1.0, =0.1.3, =0.2.1, =2.0.0b7, =3.0.14, =0.9.0, =2.5.0b1, =2.1.13, =0.0.1, =0.2.0, =0.36.0 - glamkit-sponsors 0.5.0 and more Source cves: CVE-2016-9910 Source advisory: GHSA-8F6M-GFQ9-G33V...