EUVD-2026-64656

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793

justhtml versions before 3.11.0 are affected by a cross-site scripting (XSS) vulnerability in the default sanitizer. The root cause is that event handler removal is bypassed in selectedcontent projections : an attacker can inject SVG or MathML elements carrying event handlers, which are then clon...

CVE-2026-5751

justhtml versions 1.13.0 and earlier are affected by a parser-differential / mutation XSS (mXSS) vulnerability. The issue occurs when a custom SanitizationPolicy preserves foreign namespaces (e.g., drop_foreign_namespaces=False with allowlisted SVG/MathML elements or raw-text containers such as )...

EUVD-2026-64654

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting mXSS vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces e.g., dropforeignnamespaces=False with allowlisted SVG/MathML elements or raw-text containers such as...

CVE-2026-5751 justhtml before 1.14.0 Mutation XSS via custom sanitization policies

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting mXSS vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces e.g., dropforeignnamespaces=False with allowlisted SVG/MathML elements or raw-text containers such as...

CVE-2026-5389 justhtml before 1.13.0 XSS via code fence breakout

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

EUVD-2026-64652

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers cleanurlvalue/cleanurlinjsstring, HTML serialization, Markdown passthrough htmlpassthrough=True, and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization ...

EUVD-2026-64653

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-5389

justhtml versions before 1.13.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that attacker-controlled content inside sanitized elements can contain backticks that break out of fixed-length code fences. When the resulting Markdown is ...

EUVD-2026-64651

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings via query, matches, or selector-based transforms, run selector matching over very large untrusted documents,...

poc_cve_2026_19681

CVE...

CVE-2026-70383

A flaw was found in the DigiDoc4 client. This vulnerability, categorized as an Improper Limitation of a Pathname to a Restricted Directory Path Traversal, allows a local attacker to write files to arbitrary locations on the system with active user interaction. By exploiting this flaw, an attacker...

The vulnerability of the Serial Wire Debug interface (SWD) in the highly integrated wireless system on chip (SoC) Realtek RTL8762C allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the Serial Wire Debug SWD interface in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to improper protection against voltage and clock failures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and...

The vulnerability affects the embedded energy-independent single-write eFUSE memory module in Realtek RTL8762C, a highly integrated wireless system on chip (SoC). This module allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the embedded energy-independent single-write eFUSE memory in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to the fact that power is turned on before the access control mechanism is activated. Exploiting this vulnerability can allow a hacker to...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.

The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...

The vulnerability of the Kerberos protocol for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Kerberos protocol for Windows operating systems is related to errors in the mechanism for handling relative pathnames to the directory. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...