This episode examines five critical vulnerabilities published within 24 hours, all scoring CVSS 9.4 or above. Four CVEs affect justhtml, a Python HTML sanitisation library, exposing bypass techniques including encoded malicious URLs, mixed-case tag names, and downstream Markdown conversion flaws. The fifth, CVE-2026-78207, concerns exceljs-hardened, a Node.js spreadsheet library vulnerable to prototype pollution through malicious cell notes. Corrine explains the practical attack scenarios, including unauthenticated file upload exploitation, and provides clear remediation steps. The episode emphasises supply chain visibility, noting that while these vulnerabilities are not currently on CISA’s Known Exploited Vulnerabilities catalogue, they represent genuine risk for small businesses with affected dependencies. Guidance covers patch priorities, GDPR reporting obligations for sanitisation failures, and practical steps for establishing software inventory and NVD notification processes without significant cost.