CVE-2026-25156 — HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s — CVE Database · The Intelligence Room