CVE-2026-49210 Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the client-controlled childrenid.tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly in...

SUSE-SU-2026:3104-1 Security update for python311

This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host bsc1261969. - CVE-2026-4786: URLs containing %action can bypass mitigation that allows command injection via the webbrowser.open API bsc1262319. -...

OPENSUSE-SU-2026:21367-1 Security update for lux

This update for lux fixes the following issues: Changes in lux: - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files bsc1267110 - CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content bsc1235304 -...

PT-2026-60849

Name of the Vulnerable Software and Affected Versions Feng Office version 3.11.13.11 Description An unauthenticated arbitrary file upload issue exists in the ck upload handler.php file. This allows remote attackers to upload malicious files, such as .html files, to the web-accessible /tmp/...

ROS-20260717-73-0027

The vulnerability of Google Chrome’s WebRTC technology relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a specially created HTML page...

SUSE SLES16 Security Update : go1.25 (SUSE-SU-2026:22643-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22643-1 advisory. This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6...

PT-2026-60902

Name of the Vulnerable Software and Affected Versions AngleSharp versions prior to 1.5.0 Description AngleSharp fails to correctly implement the HTML specification regarding the element. When this element has an encoding attribute set to text/html or application/xhtml+xml, it should be treated as...

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces a DOM...

CVE-2026-44175

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting XSS. Kirby's list field stores its formatted content as HTML, and unlike other field types...

MAL-2026-10752 Malicious code in xxdxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a77171f4b68ff814a7a99b5e51e3d59b9d4ca41fefbd650d2a0f8412878360 The package's sole file i.js declared as main is a heavily obfuscated IIFE whose top-level exploit runs unconditionally when the module is loaded. In...

SUSE CVE-2026-13030

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-57073

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read. Note that t...

CVE-2026-13397

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

CVE-2026-57073 HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read. Note that t...

CVE-2026-57073

HTML::Bare for Perl versions up to 0.04 is vulnerable to an unbounded character lookahead in parserc_parse, enabling out-of-bounds reads (truncated strings like

EUVD-2026-44965

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read. Note that t...

EUVD-2026-44963

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

CVE-2026-13397

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

CVE-2026-13397 HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

CVE-2026-13397

CVE-2026-13397 affects HTML::Bare up to version 0.04 for Perl. The vulnerability is an infinite loop in the parser when encountering certain malformed attributes, because parserc_parse does not advance the attribute-parse state cursor for those forms (e.g., nameless attributes like and unbalance...