Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:56:06 +0000 CVE-2026-39823 — Bypass of meta content URL escaping causes XSS in html/template https://vulnerability.circl.lu/vuln/cve-2026-39823 <p><strong>Affected:</strong> Go standard library html/template</p> <p>CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a &lt;meta&gt; tag&#39;s &lt;content&gt; attribute. If the URL content were to insert ASCII whitespaces around the &#39;=&#39; rune inside of the &lt;content&gt; attribute, the escaper would fail to similarly escape it, leading to XSS.</p> <p><strong>Affected:</strong> Go standard library html/template</p> <p>CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a &lt;meta&gt; tag&#39;s &lt;content&gt; attribute. If the URL content were to insert ASCII whitespaces around the &#39;=&#39; rune inside of the &lt;content&gt; attribute, the escaper would fail to similarly escape it, leading to XSS.</p> https://vulnerability.circl.lu/vuln/cve-2026-39823