SUSE CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

EUVD-2026-107324

odf-kit: HTML injection leading to XSS in odtToHtml and odsToHtml via unescaped style attribute values...

npm: odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

npm: odf-kit: HTML injection leading to XSS in odtToHtml and odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.6.0, 0.14.2...

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

CVE-2026-121008

A flaw was found in perl-sql-abstract. The SQL::Abstract::Tree component does not properly HTML-escape SQL text or bind values when generating output using the HTML profile. If an application displays this formatted SQL in a web interface, such as a debug panel or query log, an attacker who...

CVE-2026-121008

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

DEBIAN-CVE-2026-114627

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step...

CVE-2026-114627

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step...

SUSE CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

SUSE CVE-2026-121032

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-121033

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121042

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121051

UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-121099

Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121110

UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121124

Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-121130

Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-121135

Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-121137

Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-121138

Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...