# CVEs published 2019-04-06

3 CVEs were published on April 6, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10906](https://cve.now/CVE-2019-10906.md): In Pallets Jinja before 2.10.1, str.format\_map allows a sandbox escape. (no CVSS, jinja2)
- [CVE-2019-10905](https://cve.now/CVE-2019-10905.md): Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if… (no CVSS, erusev/parsedown)
- [CVE-2019-10904](https://cve.now/CVE-2019-10904.md): Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi\_handler.py mishandle 404 errors. (no CVSS, roundup)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.