[SECURITY] Fedora 43 Update: yq-4.53.3-1.fc43

Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor...

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...

GHSA-PGWW-W46G-26QG AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...

CVE-2026-14979

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion...

CVE-2026-14979 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion...

CVE-2026-14979 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion...

CVE-2026-14979

The CVE-2026-14979 issue affects IBM Engineering Lifecycle Management - Jazz Foundation (versions 7.0.3 with iFix001–iFix021, 7.1.0 with iFix001–iFix009, and 7.2.0 with iFix001). The root cause is an XML Entity Expansion vulnerability (CWE-776) in DOORS, enabling a remote attacker to cause a deni...

CVE-2026-9586

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

SUSE CVE-2026-13401

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

SUSE CVE-2026-57074

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read...

CVE-2026-8396 XXE in Netcad's NetGIS

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396

CVE-2026-8396 is an XML external entity (XXE) vulnerability in NetGIS from Netcad Software Inc. The issue arises from an improper restriction of XML external entity references, enabling Serialized Data External Linking. Affected products/versions: NetGIS 5.0.66 through before 7.2.2 (i.e., 5.0.66 ...

EUVD-2026-45165

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

CVE-2026-51080

CVE-2026-51080 affects the Perl libraries libpvestorage-perl (v9.1.1) and libpve-storage-perl (v8.3.7), which are reported to contain an XML External Entity (XXE) vulnerability. The connected sources explicitly identify XXE as the underlying issue and list the affected versions; no additional tec...

PT-2026-60810

Name of the Vulnerable Software and Affected Versions Sangoma Switchvox SMB Edition version 8.3 104997 Description An unauthenticated SQL injection exists where the '/pa' endpoint processes XML content starting with . The system directly concatenates the user-controlled PhoneIP value into...

PT-2026-60771

Name of the Vulnerable Software and Affected Versions libpvestorage-perl version 9.1.1 libpve-storage-perl version 8.3.7 Description An XML External Entity XXE flaw exists in the storage Perl components of Proxmox VE. This issue stems from insecure XML parsing caused by improper parser...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

Cisco IP and Video Phone Multiple Vulnerabilities (cisco-sa-ipphone-multi-vulns-cXAhCvS)

According to its self-reported version, the remote Cisco IP or Video Phone running SIP Software is affected by multiple vulnerabilities: - A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an affected device t...

PT-2026-60902

Name of the Vulnerable Software and Affected Versions AngleSharp versions prior to 1.5.0 Description AngleSharp fails to correctly implement the HTML specification regarding the element. When this element has an encoding attribute set to text/html or application/xhtml+xml, it should be treated as...