EUVD-2026-115868

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that...

CVE-2022-40317

CVE-2022-40317 Stored XSS in Notes A stored XSS was found in the notes section of the application while we were pentesting a client that was using OpenKM. Basically, when storing notes, somehow normal HTML was allowed and it was rendered as is. As you know, However, we found that using...

CVE-2023-22432

CVE-2023-22432 PoC verification of web2py vulnerability CVE-2023-22432 A vulnerability CVE-2023-22432 in web2py was disclosed on Jan 31, 2023 US time. This article describes our discussion of this vulnerability and the results of our verification. Vulnerability Summary This vulnerability is an op...

SSRF-Testing

I'm grateful for the support received by Tuta SSRF Server Side Request Forgery testing resources Quick URL based bypasses: http://google.com:80+&@127.88.23.245:22/[email protected]:80/ http://127.88.23.245:22/+&@google.com:[email protected]:80/...

PT-2026-132361

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

RHEL 6 : python-lxml (RHSA-2026:90336)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90336 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

RHEL 7 : python-lxml (RHSA-2026:90327)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90327 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

PT-2026-125033

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1 Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL...

RHEL 8 : python-lxml (RHSA-2026:90326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90326 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CentOS Linux 7 [TuxCare] Security Update: python-lxml / python-lxml-docs (CENTOS7:CLSA-2026:1792861994)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792861994 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing...

Alibaba Cloud Linux 3 : 0309: python-lxml (ALINUX3-SA-2026:0309)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0309 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-49825: lxml is a library for processing XM...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...