The vulnerability of XML components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of XML components in Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created XML file...

CVE-2026-70439

The Jenkins XML Job to Job DSL Plugin version 0.1.13 and earlier is vulnerable to a missing permission check. Attackers lacking appropriate permissions can invoke the plugin's conversion functionality. Specifically, while users can only access jobs for which they have Item/Read permission, the pl...

CVE-2026-34556

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

CVE-2026-34556

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

CVE-2026-34548

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior UB condition in the XML conversion tooling path iccToXml caused by an implicit conversion from a negative signed integer to icUInt32Number unsigned...

CVE-2026-34556 iccDEV: HBO in icAnsiToUtf8()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

CVE-2026-34556

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

EUVD-2026-17723

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

CVE-2026-34556

CVE-2026-34556 affects the iccDEV library prior to 2.3.1.6. A heap-buffer-overflow in icAnsiToUtf8() within the XML conversion path is triggered by a crafted ICC profile, causing code that assumes null-termination to read past allocated memory (ASan reports an out-of-bounds READ of size 115 past ...

CVE-2026-34556 iccDEV: HBO in icAnsiToUtf8()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

iccDEV 缓冲区错误漏洞

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.6 contained a buffer error vulnerability, which was caused by a heap buffer overflow in the icAnsiToUtf8 function during XML conversion...

PT-2026-29405

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a heap-buffer-overflow HBO in icAnsiToUtf8 in the XML conversion path. The issue is triggered by a crafted ICC profile which causes icAnsiToUtf8std::string&, char const ...

PT-2026-29393

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is an Undefined Behavior UB condition in the XML conversion tooling path iccToXml caused by an implicit conversion from a negative signed integer to icUInt32Number unsigned...

CVE-2026-25582: Heap-based Buffer Overflow

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.3, there is a heap buffer overflow read vulnerability in CIccIO::WriteUInt16Float when converting malformed XML to ICC profiles via...

CVE-2026-21693

iccDEV versions prior to 2.3.1.2 contain a Type Confusion vulnerability in CIccSegmentedCurveXml::ToXml() (IccXML/IccLibXML/IccMpeXml.cpp). The patch is in version 2.3.1.2. Affected users are those processing ICC color profiles with iccDEV. No publicly documented workarounds are provided. Remedia...

EUVD-2016-9236

Malware in sbrugna...

EUVD-2016-9237

Malware in sbrugna...

CVE-2022-33977

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service DoS condition on the server where the...

The vulnerability of the XStream Java library for converting objects to XML or JSON format allows attackers to execute arbitrary code. This vulnerability stems from deficiencies in the deserialization mechanism, enabling attackers to execute unauthorized code.

The vulnerability of the XStream library for converting objects to XML or JSON format is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows for unlimited loading of dangerous types of files, enabling attackers to load and execute arbitrary code.

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code by manipulating the...