Login Request a demo
LX
Product
lxml
by lxml · last CVE Aug 20, 2026
8
CVEs
0
On KEV
8.2
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 0High 4Medium 4Low 0
Severity
All severities8Critical0High4Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add lxml to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49825
8.2
0%
Aug 20
lxml: javascript: URL bypass in Cleaner via xlink:href
Affected: < 6.1.1
CVE-2026-41066
7.5
0%
Apr 24
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
Affected: < 6.1.0
CVE-2022-2309
7.5
2%
Jul 5
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash)
Affected: before 4.9.1
CVE-2021-43818
7.1
3%
Dec 13
lxml is a library for processing XML and HTML in the Python language
Affected: before 4.6.5
CVE-2021-28957
6.1
4%
Mar 21
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3
Affected: before 4.6.3
CVE-2020-27783
6.1
4%
Dec 3
A XSS vulnerability was discovered in python-lxml's clean module
Affected: 1.2 before 4.6.2
CVE-2018-19787
6.1
2%
Dec 2
An issue was discovered in lxml before 4.2.5
Affected: before 4.2.5
CVE-2014-3146
6.1
6%
May 14
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters…
Affected: through 3.3.4; 0.5; 0.5.1; 0.6; 0.7; 0.8; +34 more
Showing 8