https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28350.htmlhttps://patchthecve.com/cve/CVE-2026-28350.htmlWed, 17 Jun 2026 10:28:27 +0000MEDIUM 6.1: lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default Cleaner configuration. While page_structure=True removes html, head, and title tags, there is no specific handling for <base>, allowing an ahttps://patchthecve.com/cve/CVE-2026-28348.htmlhttps://patchthecve.com/cve/CVE-2026-28348.htmlWed, 17 Jun 2026 10:28:27 +0000MEDIUM 6.1: lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filhttps://patchthecve.com/cve/CVE-2024-52595.htmlhttps://patchthecve.com/cve/CVE-2024-52595.htmlWed, 17 Jun 2026 08:07:31 +0000HIGH 7.7: lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers pars