Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Published 2026-10-28 by GitHub_M

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion

Published 2026-10-28 by CPANSec

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment

Published 2026-10-28 by CPANSec

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes

Published 2026-10-28 by CPANSec

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

Published 2026-10-28 by CPANSec

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Published 2026-10-28 by GitHub_M

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename

Published 2026-10-28 by CPANSec

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters

Published 2026-10-28 by CPANSec

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message

Published 2026-10-28 by CPANSec

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous

Published 2026-10-28 by CPANSec