CVE-2026-45143 Chamilo LMS: Student-to-admin stored XSS in private messages via v-html

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

GHSA-6QW9-4VV5-JR97 Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

CVE-2026-91737

A flaw was found in Google Chrome. This use-after-free vulnerability in the PDF component allows a remote attacker to execute arbitrary code within the browser's security sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a compromise of the affect...

RLSA-2026:67943 Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-lxml security update

An update is available for python-lxml. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

USN-8777-1: GNU Bison vulnerability

It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when generating HTML reports. An attacker could possibly use this issue to execute arbitrary code...

CVE-2026-91738

An improper input validation flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=536450979...

CVE-2026-91716

An use after free flaw was found in the Auth component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=554558368...

CVE-2026-91722

An use after free flaw was found in the Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=554953456...

CVE-2026-91721

An use after free flaw was found in the Internals component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=557320614...

CVE-2026-91710

An use after free flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553132148...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-68523: Uncontrolled Resource Consumption

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...

RockyLinux 8 : python-lxml (RLSA-2026:67943)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

CVE-2026-93382: Use After Free

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-94358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Improper escaping of bookmark labels imported from notebook files occurs during rendering in the dock tree. This allows attackers to create malicious .sy notebook files containing unescaped HTML withi...

PT-2026-95125

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description An information leak exists in the Permissions component that allows a remote attacker to leak cross-origin data by using a crafted HTML page. Cross-origin data leakage occurs when a...