CVE-2026-5388 justhtml before 1.15.0 Multiple Security Issues

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

CVE-2026-41846

CVE-2026-41846...

PT-2026-79769

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers clean url value/clean url in js string, HTML serialization, Markdown passthrough html passthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass...

PT-2026-79777

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0 Description A mutation cross-site scripting mXSS issue exists during the serialization of raw-text elements, such as and . When the sanitize dom function processes a DOM tree using a custom policy that retains...

CVE-2026-53529

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69238

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69229

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

CVE-2026-61824

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

CVE-2026-69237

CVE-2026-69237 is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior . A remote attacker with administrative privileges can insert arbitrary HTML into an administrative API. Esri rates the severity as LOW (CVSS 3.8) , while NVD rates it MEDIUM (4.8) , with the key d...

EUVD-2026-64085

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

EUVD-2026-64157

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

CVE-2026-69229

Esri Portal for ArcGIS versions 12.0 and prior are affected by an HTML injection vulnerability in the Portal for ArcGIS Home application. A remote, authenticated attacker can insert arbitrary HTML into the application, resulting in low confidentiality and integrity impact (CVSS 3.1: 5.4 MEDIUM )....

CVE-2026-69229 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

CVE-2026-69238 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69238 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

EUVD-2026-64153

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

CVE-2026-69238

CVE-2026-69238 is an HTML injection vulnerability in Esri Portal for ArcGIS (versions 11.5 and prior), specifically in the Home application . A remote, highly privileged attacker with user interaction can insert arbitrary HTML into the application. NVD scores it 4.8 MEDIUM (CVSS:3.1), while Esri'...