CVE-2026-67268

Dell Command Update (DCU) versions prior to 5.7.1 contain an Improper Restriction of XML External Entity Reference (XXE) vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve elevation of privileges and server-side request forgery (SSRF) . The CVSS 3.1 base s...

CVE-2026-67268

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery...

CVE-2026-70423

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-49441: External Control of File Name or Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

PT-2026-78708

Name of the Vulnerable Software and Affected Versions IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0 IBM DS8900F versions 89.40.83.0 through 89.44.25.0 Description An authenticated user can read or modify the command history of another user. This issue occurs because the system us...

PT-2026-78501

Name of the Vulnerable Software and Affected Versions Cisco Crosswork affected versions not specified Description An internal security review identified issues related to external control of the file system. This involves a collection of vulnerabilities where an external actor could potentially...

CVE-2026-70423: Improper Restriction of XML External Entity Reference

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

PT-2026-78520

Name of the Vulnerable Software and Affected Versions RK3588s SoC BootROM secure version 350B20210512V100 Description The Secure BootROM of the RK3588s SoC is susceptible to a time-of-check to time-of-use TOCTOU attack when booting from external media such as SPI NOR, NAND, EMMC, or SD. The issue...

CVE-2026-67268: Improper Restriction of XML External Entity Reference

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery...

CVE-2026-76572: Improper Restriction of XML External Entity Reference

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...

PT-2026-78655

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...

CVE-2026-20320: Improper Restriction of XML External Entity Reference

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2026-75626

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

EUVD-2026-60577

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

XML External Entity (XXE)

Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...

PT-2026-76966

Name of the Vulnerable Software and Affected Versions Citrix WorkSpace App version 2607 Description An issue exists in Citrix WorkSpace App on MacOS that allows external control of a file name or path. This occurs when the application does not properly validate the file path provided by an extern...

CVE-2026-67920: External Control of File Name or Path

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...