PT-2026-96690

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.2 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssl versions 9.5 through 11.2.12.12 ssl versions 11.6.0 through 11.6.0.5 ssl versions 11.7.0 through 11.7.6 Descriptio...

PT-2026-97035

Name of the Vulnerable Software and Affected Versions MPXJ versions 5.5.5 through 16.4.0 Description When parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, the software creates a DocumentBuilder with default settings that leave doctype declarations and external...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

PT-2026-95959

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.27 Description An XML external entity injection issue exists in the XML2array helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to...

Security Bulletin: IBM App Connect Enterprise is vulnerable to XML Entity Expansion due to Node.js module fast-xml-parser (CVE-2026-73569)

Summary IBM App Connect Enterprise runtime is vulnerable to XML Entity Expansion due to Node.js module fast-xml-parser. Vulnerability Details CVEID:CVE-2026-73569 DESCRIPTION: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until...

PT-2026-95285

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.5 Description Stored Cross-Site Scripting occurs via the kubio/copyright Block Content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level acces...

CVE-2026-92756

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

EUVD-2026-82382

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92756

This vulnerability affects the MongoDB Entity Framework Core Provider . Applications that combine independent encryption settings with the provider's own encryption settings may silently lose TLS and schema-map settings , causing protected fields to be stored unencrypted in the database. The flaw...

CVE-2026-92756 Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...

CVE-2026-92756 Combining encryption settings may disable encryption

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database...