30
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.
Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.
30
45
30
30
CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.
CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.
30
ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.
Zero Day Initiative advisory ZDI-26-607 describes an HTML injection vulnerability in Microsoft Office that leads to information disclosure. Remote attackers need the target to visit a malicious page or open a malicious file to trigger it. ZDI rated the issue 7.6 on the CVSS scale and the advisory lists no CVE identifier. The advisory does not indicate active exploitation.
18
30
30
45
30
45
30
30
30
45
30
30
USN-8747-1: Beets vulnerability
Ubuntu released USN-8747-1 fixing a Beets web interface flaw that let attackers inject HTML or execute JavaScript via untrusted media metadata.
Ubuntu Security Notice USN-8747-1 addresses a vulnerability in the Beets music library manager, which incorrectly escaped untrusted media metadata in its web interface. An attacker could exploit this to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser. Updated packages are available for affected Ubuntu releases.
15
45
30
45
45
30
30
30
45
30
30
45
45
45
30
30
45
45
30
30
45
30