flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

CVE-2024-40445_CVE-2024-40446

MimeTeX Vulnerability Reference CVE-2024-40445 & CVE-2024-40446 This repository serves as the public reference for the security issues CVE-2024-40445 and CVE-2024-40446 affecting MimeTeX, a lightweight open-source LaTeX renderer written in C. ⚠️ MimeTeX appears to be no longer actively maintained...

GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...

[SECURITY] Fedora 45 Update: hevea-2.38-6.fc45

HEVEA is a quite complete and fast LATEX to HTML translator. HEVEA renders symbols by using the so-called HTML "entities", which modern browsers display correctly most of the time...

CVE-2026-105744

A flaw was found in docling. When configured to process LaTeX documents using the Tectonic engine, the application does not restrict TeX file operations during compilation. An attacker could exploit this vulnerability by submitting crafted document input to read sensitive files or overwrite...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. The root cause involves the handling of Mermaid and LaTeX content , which allows an attacker to execute malicious scripts in the context of other users' sessions. This vulnerability has a...

EUVD-2026-90584

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

PT-2026-103753

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103493: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9302)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249302 advisory. emacs: Gnus treats inline MIME contents as trusted CVE-2024-30203 emacs: LaTeX preview is enabled by default for e-mail attachments CVE-2024-30204 emacs: O...

ironlab-text (>=0.5.2, <=0.10.4) potentially affected by unknown CVE via latex-rust (1.0.2)

latex-rust CARGO version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on latex-rust and may be impacted: - ironlab-text =0.5.2, =0.10.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0311...

RUSTSEC-2026-0311 Stack overflow on deeply nested LaTeX input

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...

Stack overflow on deeply nested LaTeX input

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...

PT-2026-107651

The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as frac1…, braces, sqrt…, left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...