CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

CVE-2026-9390 affects XML::Sig (Perl) versions before 0.71. The issue arises when verify()/_get_signed_xml() build XPath expressions by concatenating SignedInfo/Reference/@URI from the document without escaping or enforcing NCName rules. A URI containing a single quote can terminate the string li...

CVE-2026-0392 eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server (CVE-2025-36384, CVE-2025-58056, CVE-2024-47072).

Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity. These vulnerabilities include CVE-2024-47072, CVE-2025-36442, CVE-2025-36428, CVE-2025-36427, CVE-2025-36424,...

SUSE CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or last-N...

GHSA-XH95-F55M-82FW Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Summary FramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...

CVE-2026-56131

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XMLResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service. Mitigation To mitigate this vulnerability, avoid...

Path Traversal

datamodel-code-generator is vulnerable to Path Traversal. The vulnerability is due to improper validation of schemaLocation values in XML Schema parsing xs:include, xs:import, xs:redefine, and xs:override, which allows an attacker to reference files outside the intended input base path, resulting...

The vulnerability of the XmlLayout() function in the Apache Log4j Core library allows attackers to compromise the integrity of the protected information.

The vulnerability of the XmlLayout function in the Apache Log4j Core logging library is related to improper encoding or escaping of output data. Exploiting this vulnerability allows an attacker to influence the integrity of the protected information from a remote location...

CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

EUVD-2025-210545

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

SUSE CVE-2026-55437

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

JLSEC-2026-958 ImageMagick: MSL - Stack overflow in ProcessMSLScript

Summary Magick fails to check for circular references between two MSLs, leading to a stack overflow. Details After reading a.msl using magick, the following is displayed: MSLStartElement - ReadImage - ReadMSLImage - ProcessMSLScript - xmlParseChunk - xmlParseTryOrFinish - MSLStartElement bash...

JLSEC-2026-1045 ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark()...

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...

CVE-2026-54365

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

CVE-2026-54366

CentreStack prior to 17.4 is affected by an XML External Entity (XXE) vulnerability in the SharePoint storage configuration handler. An unauthenticated attacker can exfiltrate arbitrary files by sending a crafted request to the StorageConfig endpoint, causing the server to fetch and parse attacke...

EUVD-2026-51102

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...