PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

PT-2026-79804

Name of the Vulnerable Software and Affected Versions EFM ipTIME T16000M version 14.20.2 Description Improper authentication occurs within the Session Validation Handler component due to a weakness in the httpcon check session url function. This flaw allows remote exploitation to bypass...

freetype2:ftfuzzer: Heap-buffer-overflow in tt_face_load_varc_glyph

Detailed Report: https://oss-fuzz.com/testcase?key=6574704132161536 Project: freetype2 Fuzzing Engine: afl Fuzz Target: ftfuzzer Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7b2d372ebf3e Crash State: ttfaceloadvarcglyph ttglyphload...

tarantool:uri_parse_test: Heap-use-after-free in cdata_setptr

Project: https://github.com/tarantool/tarantool.git Detailed Report: https://oss-fuzz.com/testcase?key=5666324051984384 Project: tarantool Fuzzing Engine: libFuzzer Fuzz Target: uriparsetest Job Type: libfuzzerasantarantool Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address:...

CVE-2026-5388

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-5388

justhtml (Python HTML sanitizer library) before 1.15.0 contains multiple sanitization bypass vulnerabilities across URL sanitization helpers, HTML serialization, Markdown passthrough, and custom policy edge cases. Attackers can inject active HTML and JavaScript via vectors such as encoded javascr...

mapserver:owsfuzzer: Stack-buffer-overflow in msLayoutTextSymbol

Project: https://github.com/MapServer/MapServer.git Detailed Report: https://oss-fuzz.com/testcase?key=6243451692449792 Project: mapserver Fuzzing Engine: honggfuzz Fuzz Target: owsfuzzer Job Type: honggfuzzasanmapserver Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...

hobbes:fuzz-parse-expr: Heap-buffer-overflow in yylex

Project: https://github.com/morganstanley/hobbes.git Detailed Report: https://oss-fuzz.com/testcase?key=5314345710714880 Project: hobbes Fuzzing Engine: libFuzzer Fuzz Target: fuzz-parse-expr Job Type: libfuzzerasanhobbes Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address:...

ids-traffic-analysis

Network Intrusion Detection and Traffic Analysis Platform Thi...

notevault-vapt-assessment

Black-Box VAPT Assessment — NoteVault A self-contained, repro...

PT-2026-79776

justhtml versions are preserved, so untrusted input that is safe in to html — including entity-decoded text e.g. script or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting wh...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

PT-2026-79777

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0 Description A mutation cross-site scripting mXSS issue exists during the serialization of raw-text elements, such as and . When the sanitize dom function processes a DOM tree using a custom policy that retains...

PT-2026-79764

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.8 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An authenticated user can achieve remote code execution due to a path traversal flaw in the package...

PT-2026-79767

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

PT-2026-79775

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.16.0 Description Multiple HTML sanitization bypass issues allow active or dangerous content, such as script or style tags, to survive the sanitization process, potentially leading to cross-site scripting. These...