RHEL 9 : perl-XML-LibXML (RHSA-2026:68688)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:68688 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...

EUVD-2026-81015

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

CVE-2026-76446 Cisco Identity Services Engine External Entity Injection Vulnerability

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit th...

CVE-2026-92023

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-85386

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

CVE-2026-85386

Concrete CMS before 9.5.4 is vulnerable to stored cross-site scripting via unauthenticated file upload in the Form Block component. XML and XSLT documents submitted through a public file-upload question were validated by file extension only and served inline from the application's own origin. An ...

CVE-2026-85386 Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

CVE-2026-85386 Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

EUVD-2026-80879

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

ROOT-APP-NPM-GHSA-4W3W-2RP5-G8JM GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom - Patched by Root

Root has patched GHSA-4w3w-2rp5-g8jm in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

DEBIAN-CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

UBUNTU-CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

CVE-2026-19248

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

CVE-2026-19248

CVE-2026-19248 affects Qt (qtbase) and involves an unbounded recursion vulnerability in the QDomNode destructor during QDomDocument XML parsing . When an application processes untrusted XML input through QDomDocument, the recursion in the destructor can be triggered remotely, leading to a denial-...