Threats Tagged 'cve-2026-59926'
View all threats tagged with 'cve-2026-59926'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-59926'
Click on any threat for detailed analysis and mitigation recommendations
0 In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer. Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed. Join the discussion | GCVE Database | 08/13/2026, 16:35:11 UTC Added: 09/17/2026, 01:59:08 UTC |
0 Adr viewer's Mistune component has a cross-site scripting (XSS) vulnerability in the Admonition directive due to unescaped user input in the class option. The render_admonition() function concatenates the :class: option directly into the HTML class attribute without escaping, allowing attribute injection and XSS even when HTMLRenderer is set to escape. The directive name is validated and safe, but the class option is not sanitized. Multiple specific versions of adr-viewer are affected. A patch is available. Join the discussion | GCVE Database | 08/13/2026, 16:35:11 UTC Added: 07/16/2026, 10:37:03 UTC |
0 Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1. Join the discussion | CVE Database V5 | 07/08/2026, 16:16:15 UTC Added: 07/08/2026, 16:29:09 UTC |
Showing 1 to 3 of 3 results