Linux Distros Unpatched Vulnerability : CVE-2026-28350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the tag passes through the default Cleaner...

lxml-html-clean has <base> tag injection through default Cleaner configuration

Summary The tag passes through the default Cleaner configuration. While pagestructure=True removes html, head, and title tags, there is no specific handling for , allowing an attacker to inject it and hijack relative links on the page. Details The tag is not currently in the pagestructure kill se...

GHSA-XVP8-3MHV-424C lxml-html-clean has <base> tag injection through default Cleaner configuration

Summary The tag passes through the default Cleaner configuration. While pagestructure=True removes html, head, and title tags, there is no specific handling for , allowing an attacker to inject it and hijack relative links on the page. Details The tag is not currently in the pagestructure kill se...

PT-2026-22701

Name of the Vulnerable Software and Affected Versions lxml html clean versions prior to 0.4.4 Description The software does not properly handle the tag during HTML cleaning. Specifically, the tag is not removed even when page structure=True, which removes html, head, and title tags. This allows a...