Mime Mail - Moderately critical - Information disclosure - SA-CONTRIB-2026-312

The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker...

CVE-2026-111040: Coupa Coupa Total Spend Management Platform: The platform allows persistent HTML injection into editable fields managed by TinyMCE

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the...

Linux Distros Unpatched Vulnerability : CVE-2026-121235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-120638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML...

PT-2026-137305

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

PT-2026-136978

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step...

Linux Distros Unpatched Vulnerability : CVE-2026-121008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile...

PT-2026-137309

The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-120648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing --...

CVE-2026-114627: Cross-site Scripting (XSS)

Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step...

PT-2026-136973

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. process attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped...

Linux Distros Unpatched Vulnerability : CVE-2026-114627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use...

Linux Distros Unpatched Vulnerability : CVE-2026-121200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execut...

Linux Distros Unpatched Vulnerability : CVE-2026-121135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

CVE-2026-121632: Cross-site Scripting (XSS)

Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. processattrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped...

Extended HTML Filter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-309

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120648

Perl CGI versions before 5.00 are vulnerable to HTML injection (CWE-79) because input data is placed into HTML comments without proper escaping. An attacker can submit text containing --> to prematurely close the comment block, allowing the injection of arbitrary HTML or client-side scripts in...

CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...