CVE-2026-46546

CVE-2026-46546 affects Frappe Learning Management System (LMS) prior to version 2.53.0. An authenticated user could provide specially crafted content in editable fields, which surfaces in page metadata and causes visitors’ browsers to navigate to an attacker‑chosen URL. The issue has been patched...

CVE-2026-40472

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting XSS attacks...

CVE-2025-14911

CVE-2025-14911 involves the mongo-c-driver (GridFS) where user-controlled chunkSize metadata can cause an integer overflow leading to a heap allocation failure. Affected component/file: GridFS handling in the mongo-c-driver, with the underlying issue being insufficient validation of the chunkSize...