60741 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-19248
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input. CVE-2026-19248 Note that Nessus relies...
RockyLinux 8 : libxml2 (RLSA-2026:69655)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69655 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 f...
CVE-2026-76979: XML Injection (aka Blind XPath Injection)
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...
CVE-2026-86934: Authorization Bypass Through User-Controlled Key
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Serv...
Linux Distros Unpatched Vulnerability : CVE-2026-78253
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion...
MiracleLinux 8 : libxml2-2.9.7-21.el8_10.8 (AXSA:2026-1887:09)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1887:09 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Tenable has extracted the preceding description...
Linux Distros Unpatched Vulnerability : CVE-2026-92023
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...
CVE-2026-18172
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-17646
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-18172 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-18172 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-18172
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a remote attack where an adversary could obtain sensitive information. The root cause is the improper restriction of XML external entity references (CWE-611). Affected versions include 4.0.6.0 through 4.0.10.0 (specific...
CVE-2026-93990
A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enabl...
CVE-2026-17646
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability involving the improper restriction of XML external entity references . This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific patch versions or exploit details ...
CVE-2026-17646 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-17646 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...
CVE-2026-61570
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...
EUVD-2026-84820
MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
Summary dasel's JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small sub-10 MB, deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is...