| CVE-2026-78661 |
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
|
7.5
High
|
Oct 27, 2026 |
| CVE-2026-97045 |
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
|
6.1
Medium
|
Oct 27, 2026 |
| CVE-2026-27136 |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
|
6.1
Medium
|
May 22, 2026 |
| CVE-2026-25680 |
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
|
6.5
Medium
|
May 22, 2026 |
| CVE-2026-25681 |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
|
6.1
Medium
|
May 22, 2026 |
| CVE-2026-42502 |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
|
6.1
Medium
|
May 22, 2026 |
| CVE-2026-42506 |
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
|
6.1
Medium
|
May 22, 2026 |
| CVE-2025-47911 |
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs,…
|
5.3
Medium
|
Feb 5, 2026 |
| CVE-2025-58190 |
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which…
|
5.3
Medium
|
Feb 5, 2026 |
| CVE-2025-22872 |
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as…
|
6.5
Medium
|
Apr 16, 2025 |
| CVE-2024-45338 |
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length,…
|
5.3
Medium
|
Dec 18, 2024 |
| CVE-2023-3978 |
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be
|
Not rated
|
Aug 2, 2023 |