# CVEs published 2019-04-06

3 CVEs were published on April 6, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10906](https://cve.now/CVE-2019-10906.md): In Pallets Jinja before 2.10.1, str.format\_map allows a sandbox escape. (no CVSS, jinja2)
- [CVE-2019-10905](https://cve.now/CVE-2019-10905.md): Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a (no CVSS, erusev/parsedown)
- [CVE-2019-10904](https://cve.now/CVE-2019-10904.md): Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi\_handler.py mishandle 404 errors. (no CVSS, roundup)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.