cve-2023-45612_exploit

cve-2023-45612exploit CVE-2023-45612 is a high severty security probem that allows XXE XML eXternal Entity attacks on Ktor's XML serialization that has been patched in 2023. Reproduction of the security problem Below is a detailed way of how I reproduced the problem. IntelliJ IDEA project First, ...

CVE-2026-63182

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...

PT-2026-134227

Name of the Vulnerable Software and Affected Versions LightSAML versions prior to 4.7.1 LightSAML versions prior to 5.0.1 Description LightSAML and xmlseclibs have a discrepancy regarding which assertion an inbound SAML signature covers. The Response::deserialize function uses manyElementsFromXml...

MiracleLinux 9 : qt5-qtbase-5.15.9-11.el9_8.2 (AXSA:2026-2119:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2119:03 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt:...

RockyLinux 9 : qt5-qtbase (RLSA-2026:87082)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87082 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt:...

RLSA-2026:87082 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase:...

qt5-qtbase security update

An update is available for qt5-qtbase. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Qt is a software toolkit for developing applications. The qt5-base package...

Rocky Linux 9 [CIQ] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_87082)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687082 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt: Denia...

AlmaLinux 9 : qt5-qtbase (ALSA-2026:87082)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:87082 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt: Deni...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

ALSA-2026:87082 Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase:...

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase:...

qt5-qtbase security update

5.15.9-11.2 - Fix CVE-2026-19248: unbounded recursion and ON2 behavior in QDom Resolves: RHEL-261136 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277670...

RHEL 9 : qt5-qtbase (RHSA-2026:87082)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87082 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt...

Important: Red Hat Security Advisory: qt6-qtbase security update

An update for qt6-qtbase is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RHEL 10 : qt6-qtbase (RHSA-2026:84582)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:84582 advisory. Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security Fixes:...

GHSA-C7Q8-3CH8-VQPV xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...

EUVD-2026-69241

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

XMLDOM XML Data Compromise

The vulnerability of the serialization for XML documents related to access control and management is related to the use of regular expressions, which do not sufficiently restrict the set of allowed values. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of...