MAL-2026-11011 Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

CVE-2026-14865

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

CVE-2026-14865

In Progress Telerik UI for AJAX (older than v2026.2.708), the internal LayoutBuilder processes client-state XML without disabling DTD processing, enabling unauthenticated denial of service via recursive XML entity expansion. The vulnerability affects the UI component handling client-state XML; af...

EUVD-2026-47698

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

USN-8587-1: HTML-Parser vulnerability

It was discovered that HTML-Parser incorrectly handled entity references when the input string was identical to an entity value in the lookup table. An attacker could possibly use this issue to obtain sensitive information...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XmlDecoder file when XML input containing a DOCTYPE declaration is processed by an AsyncXMLInputFactory without security configuration, leaving DTD and entity handling enabled. An attacker can...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

DEBIAN-CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817

Netty CVE-2026-56817 affects Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final, where any caller delivering bytes to a channel pipeline containing XmlDecoder can send XML with a DOCTYPE to an AsyncXMLInputFactory started without security configuration, leaving DTD/entity handl...

CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can...

EUVD-2026-46396

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

EUVD-2026-46387

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-56146

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

CVE-2026-42397

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...