45
35
45
45
45
30
45
30
CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method
CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.
The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.
25
45
30
30
30
45
30
30
30
45
30
45
30
30
30
30
30
WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf
The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.
12
30
45
45
30
30
45
30
30
30
30
30
30
30
45