CVE-2026-124023

Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its...

ROOT-OS-DEBIAN-11-CVE-2026-56409 CVE-2026-56409 in expat - Patched by Root

Root has patched CVE-2026-56409 in the expat package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-124023

Apache Axis2/C versions through 2.0.0 are vulnerable to an out-of-bounds read in the Guththila XML parser wrapper. When processing malformed XML input, the Guththila parser may return a raw input byte as an event code; the AXIOM reader wrapper then uses this value as an index into a ten-entry loo...

EUVD-2026-124339

Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its...

CVE-2026-124023 Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper

Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its...

external_expat_AOSP10_r33_CVE-2022-23852

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

Nessus_Map

Nessus Map Nessus XML Praser Requirements Python3 Django Tested on Ubuntu 18.04 Windows 11 Pro PowerShell What it does Vulnerability based parsing Service based parsing Host bases parsing Unsupported OS parsing Generate Executive Summary of scan Export parsed .nessus files to JSON file Import JSO...

CVE-2018-11761

Summary In a recent research on Apache Tika, I found a DOS Denial of Service vulnerability existed on its XML parser. It is caused that the parser improperly parses XML document. Affected Version Tested on ElasticSearch 6.3.1 using Tika 1.18 and 6.2.3 using Tika 1.17 Analysis As we know, the core...

ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

SUSE CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData in OrderedObjParser.js calls readTagExp for each less-than character in an unterminated stop-node body and...

CVE-2026-90993

A flaw was found in Apache XML Graphics Batik. An attacker who supplies specially crafted XML input can exploit an XML External Entity XXE injection vulnerability, leading to sensitive information disclosure. By forcing the XML parser to resolve external entity references, an attacker may read...

external_expat_AOSP10_r33_CVE-2022-25236

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency CISA Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Details of the vulnerabilities are...

zk-xml-probe

zk-xml-probe Static XML fixtures for authorized bug bounty testing of XML parser behaviour CVE-2026-45071...

CVE-2026-126066

A flaw was found in fast-xml-parser. When the stopNodes configuration option is enabled, the parser repeatedly rescans remaining input when encountering unterminated tag fragments. A remote attacker could exploit this vulnerability by supplying specially crafted XML input containing numerous...

CVE-2026-126066

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData in OrderedObjParser.js calls readTagExp for each less-than character in an unterminated stop-node body and...

fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

Summary With the non-default stopNodes option, a stop node's body with many "" anywhere after makes readStopNodeData rescan the entire remaining input from every " exists - OrderedObjParser.js:812-818 — on failure, i isn't advanced, so the next lookahead is neither cached nor bounded — n copies o...

GHSA-474X-HRWR-FGX4 fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

Summary With the non-default stopNodes option, a stop node's body with many "" anywhere after makes readStopNodeData rescan the entire remaining input from every " exists - OrderedObjParser.js:812-818 — on failure, i isn't advanced, so the next lookahead is neither cached nor bounded — n copies o...

npm: fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

npm: fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags vulnerability discovered by ? in WordPress npm fast-xml-parser versions = 5.11.2...

CVE-2026-126066 fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData in OrderedObjParser.js calls readTagExp for each less-than character in an unterminated stop-node body and...