CVE-2026-77354 vulnerabilities

Vulnerabilities for packages: grafana, grafana-fips...

GHSA-XHJ3-7XW9-VR34 vulnerabilities

Vulnerabilities for packages: grafana, grafana-fips...

CVE-2026-9769

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-7808

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-9769 justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-9769

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

EUVD-2026-64661

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

EUVD-2026-64658

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

CVE-2026-7808

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

EUVD-2026-64657

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

poc_cve_2026_19681

CVE...

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...