CVE-2026-17655: Improper Input Validation

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-17922: Improper Control of Generation of Code

Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17793: User Interface (UI) Misrepresentation of Critical Information

Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17752: Use After Free

Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

NPM: mathlive's Lack of Escaping of HTML allows for XSS

NPM: mathlive's Lack of Escaping of HTML allows for XSS vulnerability discovered by ? in WordPress Npm mathlive versions = 0.109.2...

GHSA-FM7P-GW32-828P mathlive's Lack of Escaping of HTML allows for XSS

Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...

mathlive's Lack of Escaping of HTML allows for XSS

Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

EUVD-2026-50421

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

GHSA-996F-334J-67G7 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or...

Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or...

CVE-2026-15900

A flaw was found in the GPU component of Google Chrome on Android. This 'use after free' vulnerability could allow a remote attacker to potentially bypass security restrictions. By tricking a user into visiting a specially crafted HTML page, an attacker could escape the browser's sandbox, leading...

CVE-2026-15903

A flaw was found in chromium-browser. This vulnerability, an out-of-bounds read and write in the V8 JavaScript engine, allows a remote attacker to execute arbitrary code. Exploitation occurs when a user visits a specially crafted HTML page, potentially leading to unauthorized actions within the...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the HTML report generation process due to improper handling of grammar-defined configuration variables. An attacker can execute arbitrary programs with the privileges of the process by supplying a crafted grammar fi...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

AZL-94133 CVE-2026-56389 affecting package bison for versions less than 3.8.2-2

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...