59129 matches found
XML External Entity (XXE) in Django
The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity XXE attack...
SOAPpy vulnerable to XXE attacks
SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted SOAP request containing a large number of nested entity references...
PYSEC-2026-923 SOAPpy vulnerable to XXE attacks
SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted SOAP request containing a large number of nested entity references...
SOAPpy vulnerable to XML External Entity attacks
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
PYSEC-2026-924 SOAPpy vulnerable to XML External Entity attacks
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
CVE-2026-40047
The camel-docling component in Apache Camel (versions 4.15.0 through 4.18.2 ) is vulnerable to Argument Injection (CWE-88) and Path Traversal (CWE-22). The DoclingProducer class fails to sufficiently validate custom CLI arguments provided via the CamelDoclingCustomArguments header before passing ...
CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...
CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...
CVE-2026-14767
creationtimestamp| type| source ---|---|--- 2026-07-06 00:45:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpwufjfkcp23 2026-07-07 00:06:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpzcpefpfw2s...
PT-2026-56059
Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.24.2 Description An XML External Entity XXE injection exists in the KNX asset import handler. The KNXProtocol.startAssetImport method processes 0.xml from a user-uploaded ETS project ZIP file using...
PT-2026-56075
Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions prior to 2.32.7 Coder versions prior to 2.33.8 Coder versions prior to 2.34.2 Description The coder open app command opens external workspace-app URLs without validating the scheme or host. If an...
Ghost Traffic: ICMP Tunneling-Based Billing Bypass in LTE Networks
Cellular data billing is a core operational mechanism for mobile Internet service providers ISPs, and a policy gap that excludes a specific protocol from usage accounting can lead to a practical security threat. Some cellular ISPs treat ICMP echo traffic as control traffic rather than user data a...
CVE-2026-13122: Reachable Assertion
OpenVPN version 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled...
PT-2026-55942
Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.0 through 2.6.20 OpenVPN versions 2.7 alpha1 through 2.7.4 Description A remote attacker can cause a denial of service when the external-auth feature is enabled. This occurs by sending a malformed authentication token that...
PT-2026-56073
Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 Description An issue exists where the UpsertWorkspaceApp function overwrites an existing application's agent id during...
CVE-2026-14722
creationtimestamp| type| source ---|---|--- 2026-07-05 12:34:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpvlkjzz4v2o...
CVE-2026-14701
creationtimestamp| type| source ---|---|--- 2026-07-05 09:54:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpvcmvrl7n2l...
Updated yt-dlp packages fix security vulnerabilities
CVE-2026-50019 If curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. CVE-2026-50023 A vulnerability exists in yt-dlp that allows a remote attacker to write...
Linux Distros Unpatched Vulnerability : CVE-2026-14612
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out- of-bounds memory access when processing an oversized...
