DEBIAN-CVE-2026-121373

The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to...

CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-111040

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

EUVD-2026-116823

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

CVE-2026-111040 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

CVE-2026-111040

The Coupa Total Spend Management Platform is vulnerable to persistent HTML injection in editable fields managed by TinyMCE . An authenticated attacker with low privileges can inject unsanitized HTML content, which is stored in the database and rendered in other users' browsers. This flaw affects ...

authcov

AuthCov Web app authorisation coverage scanning. Introduction AuthCov crawls your web application using a Chrome headless browser while logged in as a pre-defined user. It intercepts and logs API requests as well as pages loaded during the crawling phase. In the next phase it logs in under a...

EUVD-2026-116591

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...

CVE-2026-120648

A flaw was found in perl-CGI. When generating HTML comments, input is placed directly into comment tags without proper escaping. A remote attacker could exploit this flaw by submitting input that prematurely terminates the comment block, enabling the injection of arbitrary HTML or client-side...

CVE-2026-120638

A flaw was found in perl-cgi. The redirect function decodes HTML entities in target URLs before generating the HTTP Location header. A remote attacker could exploit this vulnerability by supplying a specially crafted URL containing encoded characters that bypasses application-level URL validation...

DEBIAN-CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

DEBIAN-CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

PT-2026-136980

Name of the Vulnerable Software and Affected Versions SQL::Abstract::Tree versions prior to 2.000001 04 Description An issue exists in the html profile where the format function fails to HTML-escape SQL text and bind values. Because the html profile wraps keywords and placeholders in span element...

CVE-2026-121008: Cross-site Scripting (XSS)

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

PT-2026-136918

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

Linux Distros Unpatched Vulnerability : CVE-2026-121256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execut...