Product by Debian
Lxml
8 known vulnerabilities in Lxml (Debian), 0 of them actively exploited (CISA KEV).
Key figures
8
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-43818 | HTML Cleaner allows crafted and SVG embedded scripts to pass through | 8.2 | |
| Medium | CVE-2021-28957 | lxml: Cross-Site Scripting (XSS) | 6.1 | |
| Medium | CVE-2020-27783 | Python-lxml: Cross-site Scripting | 6.1 | |
| Medium | CVE-2018-19787 | lxml: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-49825 | lxml: javascript: URL bypass in Cleaner via xlink:href | 8.2 | |
| High | CVE-2026-41066 | lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files | 7.5 | |
| Medium | CVE-2026-28350 | lxml_html_clean: <base> tag injection through default Cleaner configuration | 6.1 | |
| Medium | CVE-2026-28348 | lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes | 6.1 |