CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879

CVE-2026-6879 affects Python's xml.etree.ElementTree path handling. Element.findall() and fully-consumed Element.iterfind() exhibit O(n^2) time when using XPath index predicates like [1], [last()], or [last()-N] on documents with many siblings of the same tag. Element.find() is affected only when...

CVE-2026-66138

A vulnerability was found in Ironic-Python-Agent's IPA time syncing code. The value of the ntpserver configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root...

CVE-2026-14078

A policy bypass flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=512953564...

CVE-2026-8167

creationtimestamp| type| source ---|---|--- 2026-07-28 11:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpdyyeigg2s...

USN-8621-1 samba vulnerabilities

It was discovered that Samba's pamwinbind incorrectly handled home directory ownership when mkhomedir was enabled. A local attacker could possibly use this issue to cause a denial of service by triggering a change in ownership of the root directory. CVE-2026-15779 Arjun Basnet, Douglas Bagnall, a...

RHSA-2026:47010 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2026:46461 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2026:45116 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

SUSE-SU-2026:3341-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-15014

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...

CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...