CVE-2025-58360

CVE-2025-58360 من الإصدار 2.26.0 إلى ما قبل 2.26.2 وقبل 2.25.6، تم تحديد ثغرة في الكيان الخارجي لـ XML XXE. يقبل التطبيق إدخال XML من خلال نقطة نهاية محددة /geoserver/wms لعملية GetMap استغلال1: python3 CVE-2025-58360 -u http://example.com استغلال2: curl -X POST...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path,...

CVE-2021-29447

CVE-2021-29447 إثبات المفهوم PoC يحتوي هذا المستودع على إثبات مفهوم PoC لاستغلال الثغرة CVE-2021-29447 ، والتي تؤثر على WordPress 5.6 و5.7 باستخدام PHP 8. يوضح الاستغلال كيف يمكن للمهاجم، الذي يمتلك القدرة على رفع الملفات، استغلال ثغرة في تحليل XML في مكتبة الوسائط Media Library، مما يؤدي إلى هجو...

CVE-2024-34102

Cosmic Sting: أداة استغلال CVE-2024-34102 Cosmic Sting هي أداة مبنية على Go مصممة لاستغلال CVE-2024-34102، ثغرة تنفيذ التعليمات البرمجية عن بُعد. تفاصيل CVE-2024-34102 إصدارات Adobe Commerce 2.4.7، 2.4.6-p5، 2.4.5-p7، 2.4.4-p8 والإصدارات الأقدم تتأثر بثغرة تقييد غير صحيح لمرجع الكيان الخارجي XML...

CVE-2021-29447

ووردبريس 5.6-5.7 - ثغرة XXE بمصادقة مؤلف+ CVE-2021-29447 الاستخدام الخطوة 1. تشغيل ووردبريس $ make up-wp الخطوة 2. تشغيل خادم الويب الخاص بالمهاجم $ make up-mal الخطوة 3. توليد ملف WAV خبيث بدون حزمة wavefile npm موصى به $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

PT-2026-103830

Name of the Vulnerable Software and Affected Versions Apache Camel Quarkus versions 3.2.0 through 3.33.2 Apache Camel Quarkus versions 3.34.0 through 3.39.9 Description Improper restriction of XML External Entity XXE references in the XSLT support extension camel-quarkus-support-xalan allows an...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1776861173)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1776861173 advisory. - An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in X...

Rocky Linux 9.6 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.6:CLSA-2026:1788370561)

"The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788370561 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version...

Rocky Linux 10.2 [CIQ] Security Update: assertj-core / assertj-core-javadoc (crlsa-2026_59372)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659372 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...

[SECURITY] [DLA 4799-1] lxml security update

Debian LTS Advisory DLA-4799-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin September 28, 2026 https://wiki.debian.org/LTS Package : lxml Version : 4.9.2-1+deb12u1 CVE ID : CVE-2026-28348 CVE-2026-28350 CVE-2026-41066 CVE-2026-49825 Multiple vulnerabilities were...

CVE-2026-82386

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity...