CVE-2026-10025 IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

EUVD-2026-53441

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-71291

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

CVE-2026-71260

CVE-2026-71260 affects ESPHome up to 2026.7.0-dev. In the web_server component, a text entity with mode: password correctly masks the TEXT field in the JSON 'state', but the serialization path unconditionally writes the raw password into the JSON 'value' field via set_json_icon_state_value()/set_...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

MAL-2026-12440 Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

CVE-2026-71236

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

The CVE describes an XML External Entity (XXE) vulnerability in Eclipse ACTF up to version 1.6.0 (including ACTF-based miChecker up to 3.1.0). The underlying issue allows an attacker to access local or internal network resources via applications that use Eclipse ACTF (e.g., miChecker). Affected c...

EUVD-2026-53300

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-70374

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

Malicious Package

Overview @zzzgenesis00/mnemonic-to-key is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-69022

Name of the Vulnerable Software and Affected Versions Edit in-place field versions 0.0.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing when editing entities. The module fails to sufficiently verify access rights, enabling a malicious user to craft requests to...

PT-2026-69023

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

CVE-2026-70448: Improper Restriction of XML External Entity Reference

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...