Linux Distros Unpatched Vulnerability : CVE-2026-63317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5...

GHSA-V74W-7MR3-4QG3 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload e.g., repeated . Because the parser state is not saved between decode invocations, an attacker can trickle-feed a payload of / characters. This forces the decoder to repeatedly rescan the entire...

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload e.g., repeated . Because the parser state is not saved between decode invocations, an attacker can trickle-feed a payload of / characters. This forces the decoder to repeatedly rescan the entire...

SUSE CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

GHSA-3HRF-2GC2-MX32 Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

Summary Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an OpenAPI description is written into...

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

Summary Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an OpenAPI description is written into...

EUVD-2026-44931

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

EUVD-2026-48589

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

OESA-2026-3180 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-3182 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317

CVE-2026-63317 — Apache OpenNLP : Three code paths load a class by its fully-qualified name via Class.forName() and invoke a no-arg constructor without validation. Affected: OpenNLP versions before 2.5.10 and before 3.0.0-M5. Path 1 (GeneratorFactory) reads the class attribute from XML feature de...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

EUVD-2026-48529

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

PT-2026-64261

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

HPESBNW05085 rev.1 - HPE Unified Correlation Analyzer (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity, XML External Entity XXE; Remote: Compromise of System Integrity, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Correlation Analyzer UCA All versions prior to 4.4.11 CVSS Scores:...