PT-2026-66318

Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66303

Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-66051

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

NPM: mathlive's Lack of Escaping of HTML allows for XSS

NPM: mathlive's Lack of Escaping of HTML allows for XSS vulnerability discovered by ? in WordPress Npm mathlive versions = 0.109.2...

mathlive's Lack of Escaping of HTML allows for XSS

Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...

GHSA-FM7P-GW32-828P mathlive's Lack of Escaping of HTML allows for XSS

Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

EUVD-2026-50421

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-15900

A flaw was found in the GPU component of Google Chrome on Android. This 'use after free' vulnerability could allow a remote attacker to potentially bypass security restrictions. By tricking a user into visiting a specially crafted HTML page, an attacker could escape the browser's sandbox, leading...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

EUVD-2026-50276

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389 Arbitrary Command Execution in GNU Bison

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389

CVE-2026-56389 : GNU Bison suffers an arbitrary command execution in HTML report generation. The root cause is improper handling of grammar-defined configuration variables: a grammar file can override the executable used for the XML-to-HTML step via %define tool.xsltproc, which is passed directly...

CVE-2026-56389 Arbitrary Command Execution in GNU Bison

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

Linux Distros Unpatched Vulnerability : CVE-2026-56389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A...