bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2026-21860 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2026-21860 Source advisory: OSV:PYSEC-2026-2044...

bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

CVE-2026-34231

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

jfk-django-core (1.6.0) potentially affected by CVE-2026-34231 via slippers (0.6.2)

slippers PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on slippers and may be impacted: - jfk-django-core 1.6.0 Source cves: CVE-2026-34231 Source advisory: OSV:PYSEC-2026-2279...

PYSEC-2026-2279

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231

Slippers (Django UI component) before version 0.6.3 contains an XSS in the {% attrs %} template tag when untrusted data is interpolated into HTML attributes without escaping. The root cause is that AttrsNode.render() does not escape output, allowing injected HTML/JS to be rendered in the page. Th...

CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

jfk-django-core (1.6.0) potentially affected by CVE-2026-34231 via slippers (0.6.2)

slippers PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on slippers and may be impacted: - jfk-django-core 1.6.0 Source cves: CVE-2026-34231 Source advisory: MEND:CVE-2026-34231...

CVE-2026-34231

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

CVE-2026-34231: Improper Neutralization of Input During Web Page Generation

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML...

Slippers cross-site scripting vulnerabilities

Slippers is a Django template language enhancement tool developed by Mitchel Cabuloy. Versions of Slippers prior to 0.6.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from template tags that did not escape context variables, which could lead to cross-site scripting...

jfk-django-core (1.6.0) potentially affected by CVE-2026-34231 via slippers (0.6.2)

slippers PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on slippers and may be impacted: - jfk-django-core 1.6.0 Source cves: CVE-2026-34231 Source advisory: OSV:GHSA-W7RV-GFP4-J9J3...

GHSA-W7RV-GFP4-J9J3 Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag

Summary A Cross-site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break o...

jfk-django-core (1.6.0) potentially affected by CVE-2026-34231 via slippers (0.6.2)

slippers PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on slippers and may be impacted: - jfk-django-core 1.6.0 Source cves: CVE-2026-34231 Source advisory: SNYK:PYTHON-SLIPPERS-15857196...

jfk-django-core (1.6.0) potentially affected by CVE-2026-34231 via slippers (0.6.2)

slippers PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on slippers and may be impacted: - jfk-django-core 1.6.0 Source cves: CVE-2026-34231 Source advisory: GHSA-W7RV-GFP4-J9J3...

Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag

Summary A Cross-site Scripting XSS vulnerability exists in the % attrs % template tag of the slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break o...

PT-2026-29160

Name of the Vulnerable Software and Affected Versions Slippers versions prior to 0.6.3 Description A Cross-Site Scripting XSS issue exists in the % attrs % template tag of the Slippers Django package. When a context variable containing untrusted data is passed to % attrs %, the value is...