CVE-2026-61741

The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks in versions prior to 0.24.1 and 1.0.0-M39 . The root cause is the use of SAXParserFactory.newInstance to obtain a javax.xml.parsers.SAXParserFactory without any security configuration, allowing the parser to resolve D...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

EUVD-2026-86332

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

SUSE CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Summary HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any https request Streamlink makes can be redirected by the...

Security Bulletin: IBM ContextForge MCP Gateway is affected by path traversal

Summary IBM ContextForge MCP Gateway Admin API contains a path traversal vulnerability in the administrative log download handler /v1/admin/logs/file where an authenticated user with administrative privileges can retrieve files from sibling directories sharing a common path prefix with the log...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

EUVD-2026-85782

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

The mammoth (aka mammoth.js) library before version 1.12.2 is vulnerable to prototype pollution when processing styles defined in a document. By converting a crafted .docx file, an attacker can add arbitrary properties to Object.prototype . Additionally, in versions 1.11.0 through 1.12.1 , applic...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151: Improperly Controlled Modification of Object Prototype Attributes

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-85057: Improper Access Control

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

PT-2026-98218

Name of the Vulnerable Software and Affected Versions http4s-scala-xml versions prior to 0.24.1 http4s-scala-xml versions prior to 1.0.0-M39 Description EntityDecoderF, scala.xml.Elem instances used to parse XML message bodies utilize a javax.xml.parsers.SAXParserFactory without security...

PT-2026-98201

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.12 ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Actions V1 allows an organization Action author with ORG OWNER, org.action.write, and org.flow.write permissions to read files from the host...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

DEBIAN-CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...