20155 matches found
CVE-2026-57257
During the PRC parsing stage, there is a lack of boundary verification for the PRC entity index, which leads to an out-of-bounds read of the entity array. As a result, the application crashes...
CVE-2026-57257
CVE-2026-57257 impacts Foxit PDF Editor/Reader (PRC 3D BRep Renderer). During PRC parsing, there is a boundary-verification flaw for the PRC entity index, causing an out-of-bounds read of the entity array and resulting in a crash. CVSS: 6.1 (Local, Low attack complexity, User interaction required...
PT-2026-56356
Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description During the PRC parsing stage, a lack of boundary verification for the PRC entity index allows an out-of-bounds read of the entity array, causing the application to crash...
CVE-2026-57259: Improper Restriction of XML External Entity Reference
The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF will be sent to the parser. Malicious documents will construct malicious external entities that, through the protocol, point to local path...
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
Bio.Entrez in Biopython through 1.86 allows doctype XXE...
PYSEC-2026-1221 Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
Bio.Entrez in Biopython through 1.86 allows doctype XXE...
Peppol-py is vulnerable to XXE attacks due to Saxon configuration
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...
PYSEC-2026-1765 Peppol-py is vulnerable to XXE attacks due to Saxon configuration
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...
Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
SummaryAn authenticated party can add a malicious name to the Energy entity, allowing for Cross-Site Scripting attacks against anyone who can see the Energy dashboard, when they hover over any information point The blue bar in the picture belowAn alternative, and more impactful scenario, is that...
PYSEC-2026-1453 Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
Summary An authenticated party can add a malicious name to the Energy entity, allowing for Cross-Site Scripting attacks against anyone who can see the Energy dashboard, when they hover over any information point The blue bar in the picture below An alternative, and more impactful scenario, is tha...
PYSEC-2026-1520 LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing
The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSLT without any...
LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing
The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSLT without any...
PYSEC-2026-1515 Langchain Community Vulnerable to XML External Entity (XXE) Attacks
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which can lead to sensitive informati...
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which can lead to sensitive informati...
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
SummaryUsing idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity function i...
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...
Langroid Allows XXE Injection via XMLToolMessage
SummaryA LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. DetailsXMLToolMessage uses lxml without...
PYSEC-2026-1532 Langroid Allows XXE Injection via XMLToolMessage
Summary A LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Details XMLToolMessage uses lxml without safeguards:...
MAL-2026-6940 Malicious code in rnx-align-deps (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd85779926afc494fd03f154fa151e30ee831b5aa8f260e01b29ee8f7a676d5 No a static rule matches and no behavioral findings were produced for this package version. There is no evidence of credential access, network...