CVE-2024-40445_CVE-2024-40446

MimeTeX脆弱性リファレンス CVE-2024-40445 & CVE-2024-40446 このリポジトリは、C言語で書かれた軽量なオープンソースのLaTeXレンダラーMimeTeXに影響を与えるセキュリティ問題CVE-2024-40445およびCVE-2024-40446の公開リファレンスとして機能します。 ⚠️ MimeTeXはもはや積極的にメンテナンスされていないようです。ユーザーと開発者は、本番環境で使用する前にリスクを評価することを強くお勧めします。 脆弱性 CVE-2024-40445 — ディレクトリトラバーサル MimeTeX...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

EUVD-2026-90584

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. The root cause involves the handling of Mermaid and LaTeX content , which allows an attacker to execute malicious scripts in the context of other users' sessions. This vulnerability has a...

PT-2026-103753

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9302)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249302 advisory. emacs: Gnus treats inline MIME contents as trusted CVE-2024-30203 emacs: LaTeX preview is enabled by default for e-mail attachments CVE-2024-30204 emacs: O...

Stack overflow on deeply nested LaTeX input

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in its xelatex converter . Authenticated attackers can upload .tex files containing \input{path} or \verbatiminput{path} directives, causing the TeX engine to read arbitrary files accessible to the server process and include their cont...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

EUVD-2026-71225

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

PT-2026-85542

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing inputpath or verbatiminputpath directives to have the TeX engine read...

CVE-2026-53531

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one or more native stack frame per nesting level at , \left, \sqrt, ^, etc, with no maximum depth limit. A short, 10 KB input of nested groups overflows the 8 MB...

EUVD-2026-64180

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one or more native stack frame per nesting level at , \left, \sqrt, ^, etc, with no maximum depth limit. A short, 10 KB input of nested groups overflows the 8 MB...

Cross-site Scripting (XSS)

Overview mathlive is an A web component for math input Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Box.toMarkup method src/core/box.ts and the MathML serializer src/formats/atom-to-math-ml.ts, which emit literal characters from LaTeX text-mode commands into...