CVE-2026-8630

justhtml versions ≤ 1.11.0 contain a mutation XSS (mXSS) vulnerability in the serialization of raw-text elements (, [removed]). When sanitize_dom() is invoked with a custom policy that retains these elements, text nodes inside them are serialized without escaping, allowing an attacker to inject a...

EUVD-2026-64660

justhtml before 1.12.0 versions and . When a DOM tree is processed by sanitizedom using a custom policy that keeps these elements, text nodes inside them are serialized literally without escaping, allowing attacker-controlled text containing the matching closing tag sequence to break out of the...

CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that inline code spans fail to treat blank lines as block boundaries. An attacker can inject blank lines into or element text to break the inline sp...

EUVD-2026-64657

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-77088 justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

EUVD-2026-64653

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389

justhtml versions before 1.13.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that attacker-controlled content inside sanitized elements can contain backticks that break out of fixed-length code fences. When the resulting Markdown is ...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

EUVD-2026-64651

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671 justhtml before 1.18.0 Denial of Service via CSS Selector

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

CVE-2026-4671

justhtml (Python HTML sanitizer library) versions before 1.18.0 contain multiple denial-of-service vulnerabilities in CSS selector handling and linkification . Attacker-controlled selector strings passed to query(), matches(), or selector-based transforms, or linkification over untrusted text, ca...

CVE-2026-70383

A flaw was found in the DigiDoc4 client. This vulnerability, categorized as an Improper Limitation of a Pathname to a Restricted Directory Path Traversal, allows a local attacker to write files to arbitrary locations on the system with active user interaction. By exploiting this flaw, an attacker...

Vulnerability handling in Zimbra Collaboration Suite

Zimbra has identified a vulnerability in the Zimbra Collaboration Suite. This vulnerability exists in the Zimbra Collaboration Suite version 10.1.20. Unauthorized attackers can execute OS commands through specially crafted SMTP requests. This requires that the Zimbra SNMP package be installed and...

Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...

MAL-2026-14380 Malicious code in fund-list-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...