CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

EUVD-2026-68654

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-17615

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. The root cause is that SourceProvider.writeTo() creates a SAXParser without disabling external entity resolution. An unauthenticated attacker can exploit this by sending a specially crafted XML bo...

CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-82880

YaCy Search Server through 1.941 is affected by an XML External Entity (XXE) injection vulnerability in its SVG , FreeMind , and OpenSearch parsers, which fail to disable external entity resolution. An unauthenticated remote attacker can publish a malicious document containing a DOCTYPE declarati...

CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service DoS, making the affected system or application...

CVE-2026-82880: Improper Restriction of XML External Entity Reference

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-52730: Missing Authorization

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

PT-2026-83784

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

PT-2026-83884

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw in the SourceProvider allows an unauthenticated attacker to perform a remote file read. By sending a specially crafted XML body containing a DOCTYPE declaration that references extern...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

Linux Distros Unpatched Vulnerability : CVE-2026-17615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending ...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-55425

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

Information Exposure

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Information Exposure in the system catalog entity titles API endpoint, which returns requested database fields without filtering out ones marked protected. A user with a standar...

Malicious code in 3layerdipstacko8li9w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9886025a6437b781a80821d6f113c08dea138ee45899438c19bf9e7cf3e366c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...