EUVD-2026-86274

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385: Undefined Security Weakness

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-61741: Improper Restriction of XML External Entity Reference

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-63498: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

PT-2026-98284

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The SOAP XML parser contains a flaw where the cleanup xml node function recurses once per XML nesting level without a depth limit. An unauthenticated attacker ca...

PT-2026-98145

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...

PT-2026-99155

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

PT-2026-99156

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

PT-2026-99157

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

Security update for ruby3.4 (important)

openSUSE security update: security update for ruby3.4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21878-1 Rating: important References: bsc1250016 bsc1255833 bsc1259239 bsc1262441 bsc1268011 bsc1268337 bsc1268338 bsc1268339 Cross-References:...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:71420)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71420 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

SUSE CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-86934

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Serv...