ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

CLSA-2026-1792530394 TuxCare security update for @babel/helper-split-export-declaration (2 CVEs)

TuxCare rebuilt @babel/helper-split-export-declaration to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792530389 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792530388 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792530387 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

Astra Linux – Vulnerability in tinyxml

In the TiXmlDeclaration::Parse method in tinyxmlparser.cpp within TinyXML, up to version 2.6.2, there is a potentially exploitable assertion which can lead to application exit. This issue occurs when a malicious XML document is used, where a null character \0 is placed after a whitespace...

CVE-2026-89124

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

CVE-2026-89124

The Display Product Catalog Based on Customs Declaration application within SAP Global Trade Services, edition for SAP HANA contains a missing authorization check (CWE-863). This flaw allows an authenticated low-privileged user to access sensitive information outside their intended authorization ...

EUVD-2026-98202

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

CVE-2026-89124 Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

PT-2026-111147

Name of the Vulnerable Software and Affected Versions Display Product Catalog Based on Customs Declaration affected versions not specified Description Insufficient authorization checks within certain functionality allow an authenticated low-privileged user to access sensitive information beyond...

CVE-2026-89124: Incorrect Authorization

Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impac...

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

Summary A crafted SVG file 1009 bytes crashes the PHP process when sanitized by enshrined/svg-sanitize any version through 0.22.x. The sanitizer's cleanAttributesOnWhitelist method calls DOMElement::removeAttribute twice on the same attribute name — first removing the explicit attribute, then...

Exploit for CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFacto...

GHSA-27P8-2357-5QQV xmldom: DocType `name` Injection Bypasses requireWellFormed

Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...

CVE-2026-85665 Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...

EUVD-2026-68654

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

EUVD-2026-68466

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-72711

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...