30
30
30
30
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.
Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.
30
CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).
Robert Rothenberg disclosed CVE-2026-85484 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders option group labels and radio button labels into HTML without escaping, which can enable cross-site scripting in applications using the rendered markup. The issue is addressed in version 0.410002.
28
30
30
30
Survey of filesystem MCP servers: how the "sandboxed filesystem" boundary is enforced (one breach, four defended-by-design)
Survey finds one filesystem MCP server vulnerable to a symlink-based sandbox escape while four others are defended by design.
A survey of five filesystem MCP servers assessed how each enforces its path-confinement boundary against symlink escapes in recursive directory walkers. The iceener/files-stdio-mcp-server is vulnerable to a read-side sandbox escape. The other four are defended by design or make no confinement claim. The author describes the vulnerability class as small but real.
30
30
45
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30
CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection
Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.
Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
18
USN-8747-1: Beets vulnerability
Ubuntu released USN-8747-1 fixing a Beets web interface flaw that let attackers inject HTML or execute JavaScript via untrusted media metadata.
Ubuntu Security Notice USN-8747-1 addresses a vulnerability in the Beets music library manager, which incorrectly escaped untrusted media metadata in its web interface. An attacker could exploit this to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser. Updated packages are available for affected Ubuntu releases.
15
USN-8734-1: PHP vulnerabilities
Ubuntu issued USN-8734-1 fixing three PHP denial-of-service flaws in SOAP, metaphone() and phar handling, including CVE-2026-7262 and CVE-2026-7568.
Ubuntu security notice USN-8734-1 addresses multiple PHP vulnerabilities. CVE-2026-7262 is a NULL pointer dereference in Apache map decoding in SOAP servers with a typemap configured; CVE-2026-7568 is a signed integer overflow in metaphone() causing an out-of-bounds read; and CVE-2026-7260 involves unbounded recursion from circular symbolic links in phar archives. All issues could allow remote attackers to cause denial-of-service conditions.
25