XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

CVE-2026-21433: Server-Side Request Forgery (SSRF)

Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band OOB requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http://emblog/admin/media.php which contains external resource references. When the...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-36898: gpiolib: cdev: fix uninitialised kfifo bsc1225736. CVE-2024-46858: mptcp: pm: Fix uaf in timerdeletesync bsc1231088. CVE-2024-50142: xfrm: validate new...