CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56817

Netty CVE-2026-56817 affects Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final, where any caller delivering bytes to a channel pipeline containing XmlDecoder can send XML with a DOCTYPE to an AsyncXMLInputFactory started without security configuration, leaving DTD/entity handl...

CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-55471

A flaw was found in the HAPI FHIR XsltUtilities component. The saxonTransform functions within this utility do not adequately restrict external entity access when processing XML. This oversight allows an attacker, who can control or tamper with the XML data being transformed, to inject malicious...

MGASA-2026-0277 Updated xmlstarlet package fixes a security vulnerability

The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...

Updated xmlstarlet package fixes a security vulnerability

The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...

MAL-2026-10840 Malicious code in @gocortexio/npmgremlinbox-ms-lpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c00cf6119e52189754e58f2c2460b83968a20c5086aa9424d58123b077c9e7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10781 Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

EUVD-2026-45180

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

Vulnerabilities in Adobe Experience Manager

Adobe has identified several vulnerabilities in Adobe Experience Manager. These vulnerabilities include an absence of authentication at a critical function, allowing unauthorized actions to occur without user interaction. Additionally, there is a Server-Side Request Forgery SSRF vulnerability tha...

CVE-2026-8396

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396 XXE in Netcad's NetGIS

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396 XXE in Netcad's NetGIS

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396

CVE-2026-8396 is an XML external entity (XXE) vulnerability in NetGIS from Netcad Software Inc. The issue arises from an improper restriction of XML external entity references, enabling Serialized Data External Linking. Affected products/versions: NetGIS 5.0.66 through before 7.2.2 (i.e., 5.0.66 ...

EUVD-2026-45165

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

PT-2026-60743

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

CVE-2026-51080

CVE-2026-51080 affects the Perl libraries libpvestorage-perl (v9.1.1) and libpve-storage-perl (v8.3.7), which are reported to contain an XML External Entity (XXE) vulnerability. The connected sources explicitly identify XXE as the underlying issue and list the affected versions; no additional tec...

PT-2026-60771

Name of the Vulnerable Software and Affected Versions libpvestorage-perl version 9.1.1 libpve-storage-perl version 8.3.7 Description An XML External Entity XXE flaw exists in the storage Perl components of Proxmox VE. This issue stems from insecure XML parsing caused by improper parser...