VUL4J-59

jsoup: Java HTML parser that makes sense of real-world HTML soup. jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_39893)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639893 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

CentOS Linux 6 [TuxCare] Security Update: spamassassin Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777548877)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777548877 advisory. - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certai...

AlmaLinux 9.6 [TuxCare] Security Update: jsoup / jsoup-javadoc (ALMALINUX9.6:CLSA-2026:1786713516)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786713516 advisory. - jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitiz...

Rocky Linux 10.2 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_40856)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202640856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

Rocky Linux 10.2 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_39183)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_41949)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202641949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

AlmaLinux 9.2 [TuxCare] Security Update: jsoup / jsoup-javadoc (ALMALINUX9.2:CLSA-2026:1784900402)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784900402 advisory. - jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable ...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_39798)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639798 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Bug Fixes and Enhancements: python3.9 testssl fai...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_39771)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639771 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (crlsa-2026_39320)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639320 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Important: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...

CVE-2026-89193

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

EUVD-2026-89616

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

CVE-2026-89193

The Robin Image Optimizer WordPress plugin, in versions prior to 2.0.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin's bundled HTML parser fails to escape values re-emitted into element attributes when a non-default image delivery mode is enabled. This ...

CVE-2026-89193 Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

CVE-2026-89193 Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...