PT-2026-71939

Name of the Vulnerable Software and Affected Versions eyaushev swagger-testcase-mcp affected versions not specified Description A flaw in the fetch swagger component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an...

Linux Distros Unpatched Vulnerability : CVE-2026-73569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.j...

PT-2026-80165

Name of the Vulnerable Software and Affected Versions NLTK affected versions not specified Description The nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser functions enumerate parses top-down without a limit on recursive steps. A specially crafted context-free grammar can caus...

ca.uhn.hapi.fhir/hapi-fhir-base: HAPI FHIR: Denial of Service via unbounded recursion in XHTML narrative parser

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The XHTML narrative parser does not limit element nesting depth, which allows a deeply nested narrative to trigger unbounded recursion. A remote attacker can exploit this vulnerability by submitting FHIR resources...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

UBUNTU-CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-56657

A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A remote attacker could potentially exploit this by submitting a specially crafted SSH key, leading to the unavailability of the Gitea service. Mitigation Mitigation for this issue is either not availabl...

DEBIAN-CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

UBUNTU-CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

UBUNTU-CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73643

js-yaml versions 5.0.0–5.2.2 expose a denial-of-service via exponential parsing time when loading untrusted YAML. In src/parser/parser.ts, readFlowCollection can double-parse nested flow sequences, causing O(2^n) work and potential CPU exhaustion for inputs under 200 bytes. Fixed in version 5.2.2...

EUVD-2026-58184

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: MEND:CVE-2026-73569...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

CVE-2026-73569 affects fast-xml-parser (OrderedObjParser.js). When parsing a single XML with multiple DOCTYPE declarations (versions 5.9.3–5.10.1), addInputEntities() repeatedly resets entity-expansion limits, allowing repeated resets within one parse. This can cause excessive CPU use, event-loop...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...