https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-12T01:45:38.770646+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2021-28957 CVE-2021-28957 2026-11-12T01:45:38.772455+00:00

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

 https://db.gcve.eu/vuln/usn-4896-1 USN-4896-1 — lxml vulnerability 2026-11-12T01:45:38.772526+00:00

Affected: Ubuntu:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml

It was discovered that lxml incorrectly handled certain HTML attributes. A remote attacker could possibly use this issue to perform cross-site scripting (XSS) attacks.