EUVD-2026-102241

ammonia: mXSS via MathML annotation-xml encoding strip...

SUSE CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

Linux Distros Unpatched Vulnerability : CVE-2026-63430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag,...

CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

UBUNTU-CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

DEBIAN-CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-63430

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

CVE-2026-63430: Improper Neutralization of Input During Web Page Generation

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

EUVD-2026-96213

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-104083 SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content , which the custom HTML sanitizer treats as inert CDATA text but browsers...

CVE-2026-104083

SmarterMail versions before build 9777 are vulnerable to a stored mutation cross-site scripting (XSS) vulnerability. The root cause lies in a custom HTML sanitizer that incorrectly treats a element nested within MathML foreign content (specifically ) as inert CDATA text, while browsers reparse i...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2024_9473)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249473 advisory. encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156...

CVE-2026-92106

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...

EEF-CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's tex...