PT-2026-89151

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

Kibana 9.1.x < 9.4.6 / 9.5.x < 9.5.2 Incorrect Authorization (ESA-2026-130)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-130 advisory. - Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via...

PT-2026-89006

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...

Kibana 8.x < 8.19.21 / 9.0.3 < 9.4.6 Missing Authorization (ESA-2026-155)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.3 prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-155 advisory. - Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential...

GHSA-97QJ-X29F-37W7 NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory each nesting level multiplies by ten, a denial-of-service. Affected call sites...

EUVD-2026-65227

NLTK: Entity-expansion DoS billion laughs via remaining raw ElementTree parses...

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory each nesting level multiplies by ten, a denial-of-service. Affected call sites...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details CVEID:CVE-2026-49875 DESCRIPTION: Apache CXF's...

Security Bulletin: IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

Summary IBM webMethods Integration Server is vulnerable to an XML external entity injection XXE attack when processing XML data. CVE-2026-2310. Vulnerability Details CVEID:CVE-2026-2310 DESCRIPTION: IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when...

DEBIAN-CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

UBUNTU-CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-19614

CVE-2026-19614 is an XML External Entity (XXE) injection vulnerability in the API of CyberELF NanoXML version 2.2.3 . The root cause is that XML external entity support is enabled by default , allowing an attacker to craft malicious XML input that references external entities. The CVSS 4.0 base s...

CVE-2026-19614 XML External Entity (XXE) Injection in CyberELF NanoXML

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-19614 XML External Entity (XXE) Injection in CyberELF NanoXML

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-71375

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2026-71375

Cosminexus Component Container by Hitachi is affected by an XML external entity (XXE) injection flaw, caused by improper restriction of XML external entity references. The vulnerability spans a wide range of versions from 09-00 through 09-00-18 up to 11-70-01 (each with specific fixed versions, e...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

EUVD-2026-72655

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...