CVE-2026-10025

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-10025

IBM QRadar SIEM is affected by CVE-2026-10025 due to an XML External Entity (XXE) injection in the parseXmlPayload() function of the event processing pipeline (q1labs_core.jar). The vulnerability is triggered when XML-format property autodetection is enabled on at least one log source type and XM...

EUVD-2026-53441

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

CVE-2026-71260

CVE-2026-71260 affects ESPHome up to 2026.7.0-dev. In the web_server component, a text entity with mode: password correctly masks the TEXT field in the JSON 'state', but the serialization path unconditionally writes the raw password into the JSON 'value' field via set_json_icon_state_value()/set_...

MAL-2026-12440 Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

CVE-2026-71236

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

The CVE describes an XML External Entity (XXE) vulnerability in Eclipse ACTF up to version 1.6.0 (including ACTF-based miChecker up to 3.1.0). The underlying issue allows an attacker to access local or internal network resources via applications that use Eclipse ACTF (e.g., miChecker). Affected c...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

EUVD-2026-53300

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

Malicious Package

Overview @zzzgenesis00/mnemonic-to-key is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-69022

Name of the Vulnerable Software and Affected Versions Edit in-place field versions 0.0.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing when editing entities. The module fails to sufficiently verify access rights, enabling a malicious user to craft requests to...

CVE-2026-71291: Improper Neutralization of Special Elements Used in a Template Engine

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

PT-2026-68133

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description The web server component discloses plaintext passwords. In the WebServer::text json function, text entities configured with mode: password have their JSON state field masked, but the raw...

CVE-2026-10025: Improper Restriction of XML External Entity Reference

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-70448: Improper Restriction of XML External Entity Reference

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...