Oracle WebLogic Server Apache Log4j (July 2026 CPU) (12.2.1.4.0)

The 12.2.1.4.0 version of WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producin...

CVE-2026-51080

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

CVE-2026-57074

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parsercparse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read...

perl-XML-LibXML security update

An update is available for perl-XML-LibXML. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module implements a Perl interface to the GNOME libxml2 library...

perl-XML-LibXML security update

An update is available for perl-XML-LibXML. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module implements a Perl interface to the GNOME libxml2 library...

CVE-2026-57097

CVE-2026-57097 describes an Untrusted search path in Microsoft XML that allows a physical attacker to bypass a security feature. Affects Microsoft XML; impact is described as high for confidentiality, integrity, and availability with a physical attack requiring no user interaction. No exploit det...

Microsoft XML Security Feature Bypass Vulnerability

Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack...

Microsoft XML Core Services Elevation of Privilege Vulnerability

Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally...

CVE-2026-55466

CVE-2026-55466 (Snipe-IT) is a stored XSS vulnerability in the UploadFileRequest path before version 8.6.2. The sanitizer only processes SVG content when PHP finfo reports image/svg+xml, and UploadedFilesController serves attachments inline without StorageHelper::allowSafeInline(), enabling a low...

USN-8520-1: Expat vulnerability

It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service...

PYSEC-2026-1993 unstructured XML External Entity (XXE)

unstructured v.0.14.2 and before is vulnerable to XML External Entity XXE via the XMLParser...

PYSEC-2026-1431 Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference

RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity...

glib2: Fix of CVE-2026-58016

CVE-2026-58016: fix XML parser state handling for element nesting in D-Bus introspection XML...

PYSEC-2026-801 XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute Nova Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack...

PYSEC-2026-930 OpenStack Swift Unchecked user input in XML responses

XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name...

Chromium: CVE-2026-14000 Inappropriate implementation in XML

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-13835 Inappropriate implementation in XML

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PYSEC-2026-724 Out-of-bounds Write in OpenCV

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 corresponds with OpenCV-Python 4.1.0.25. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An...

EUVD-2026-40521

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-56364 ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...