CVE-2026-58234: Improper Restriction of Recursive Entity References in DTDs

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

USN-8587-1 libhtml-parser-perl vulnerability

It was discovered that HTML-Parser incorrectly handled entity references when the input string was identical to an entity value in the lookup table. An attacker could possibly use this issue to obtain sensitive information...

USN-8587-1: HTML-Parser vulnerability

It was discovered that HTML-Parser incorrectly handled entity references when the input string was identical to an entity value in the lookup table. An attacker could possibly use this issue to obtain sensitive information...

SUSE CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

PYSEC-2026-923 SOAPpy vulnerable to XXE attacks

SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted SOAP request containing a large number of nested entity references...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview ultimate-sitemap-parser is an A performant library for parsing and crawling sitemaps Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' through the sitemaptreeforhomepage and sitemapfromstr functions when...

PT-2026-48591

Name of the Vulnerable Software and Affected Versions Drupal Tagify versions 0.0.0 through 1.2.52 Description Stored Cross-site Scripting XSS occurs because the module fails to properly sanitize the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This allows an...

Adobe ColdFusion 输入验证错误漏洞

Adobe ColdFusion is a rapid application development platform provided by Adobe Inc. This platform includes an integrated development environment and a scripting language. Versions of Adobe ColdFusion such as 2023.19, 2025.8, and earlier have code vulnerabilities. These vulnerabilities stem from...

CVE-2026-23822: Improper Restriction of Recursive Entity References in DTDs

A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruptio...

GHSA-J9RH-P96M-MHHP jOpenDocument has an improper restriction of XML external entity reference vulnerability

Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This issue affects jOpenDocument: 1.5...

RTI Connext Professional 代码问题漏洞

RTI Connext Professional is a connectivity platform developed by RTI Corporation in the United States, designed to meet the demanding requirements of Industrial Internet of Things IIoT. There is a code vulnerability in RTI Connext Professional, which stems from improper restrictions on XML extern...

DEBIAN-CVE-2026-6732

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition XSD validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that...

CVE-2026-6732 Libxml2: libxml2: denial of service via crafted xsd-validated document

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition XSD validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that...

Denial-Of-Service (DoS)

libxmljs is vulnerable to a segmentation fault leading to denial-of-service DoS. The vulnerability is due to improper handling of the internal ref property in entityref and entitydecl nodes when parsing specially crafted XML documents, which allows an attacker to trigger a crash by supplying...

CVE-2026-40260: Improper Restriction of Recursive Entity References in DTDs

pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has...

CVE-2026-27807: Improper Restriction of Recursive Entity References in DTDs

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities e.g., assignment settings. These YAML files are parsed with aliases enabled. This issue has been patch...

CVE-2026-29074: Improper Restriction of Recursive Entity References in DTDs

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansi...

Apache Syncope Code Issue Vulnerability

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope there is a code problem vulnerability , the vulnerability...

Apache SIS 安全漏洞

Apache SIS is an open source library for spatial information from the Apache Foundation. A security vulnerability exists in Apache SIS versions 0.4 through 1.5, which stems from an improperly restricted XML external entity reference that could result in reading a server-local file...