CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-81807

The Simple Ajax Chat WordPress plugin (versions before 20260827 ) is vulnerable to unauthenticated stored XSS due to a failure to escape chat message content before rendering. This allow unauthenticated users to inject arbitrary HTML attributes, enabling the execution of malicious scripts in the ...

CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-4671

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

EUVD-2026-64651

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671

justhtml (Python HTML sanitizer library) versions before 1.18.0 contain multiple denial-of-service vulnerabilities in CSS selector handling and linkification . Attacker-controlled selector strings passed to query(), matches(), or selector-based transforms, or linkification over untrusted text, ca...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671: Uncontrolled Resource Consumption

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

Regular Expression Denial of Service (ReDoS)

Overview bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the LinkifyFilter.handleemailaddresses function. An attacker can cause excessive CPU...

Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parseemail=True. The implementation scans attacker-controlled text with EMAILRE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...

PT-2026-52868

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parse email=True. The implementation scans attacker-controlled text with EMAIL RE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...

CVE-2026-40565

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters " in the URL. HTMLPurifier called first via...

Infinite loop

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Infinite loop in the handling of CSS selectors and linkification processes. An attacker can cause excessive CPU or memory consumption by supplying specially crafted selector...

justhtml introduces denial-of-service hardening

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

GHSA-R8CJ-3554-33MR justhtml introduces denial-of-service hardening

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

PT-2026-41810

Summary justhtml 1.18.0 fixes multiple low-severity denial-of-service hardening issues in CSS selector handling and linkification. These issues are availability concerns. They do not allow script execution, data disclosure, or sanitizer bypass by themselves. Affected versions - justhtml 1.18.0...

PT-2026-79768

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.18.0 Description Multiple low-severity denial-of-service issues exist in CSS selector handling and linkification. Applications may consume disproportionate CPU or memory when evaluating attacker-controlled selector...