PT-2026-83784

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-82880: Improper Restriction of XML External Entity Reference

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

PT-2026-83884

Name of the Vulnerable Software and Affected Versions RESTEasy affected versions not specified Description A flaw in the SourceProvider allows an unauthenticated attacker to perform a remote file read. By sending a specially crafted XML body containing a DOCTYPE declaration that references extern...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

PT-2026-83371

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.28.30 mapfish-print versions prior to 3.30.32 mapfish-print versions prior to 3.31.24 mapfish-print versions prior to 3.33.16 mapfish-print versions prior to 4.0.5 Description MapFish Print fails to disable...

CVE-2026-55848: Improper Restriction of XML External Entity Reference

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

assertj-core security update

An update is available for assertj-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A rich and intuitive set of strongly-typed assertions to use for unit...

AlmaLinux 9 : assertj-core (ALSA-2026:60215)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:60215 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

RLSA-2026:59372 Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: obs-server (UTSA-2026-093681)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093681 advisory. A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: apache-poi (UTSA-2026-093250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093250 advisory. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker...

ALSA-2026:60215 Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

assertj-core security update

3.24.2-9.1 - Fix CVE-2026-24400: add XXE protection to XmlStringPrettyFormatter - Resolves: RHEL-183469...

Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Apicurio/apicurio-registry: apicurio-registry: Unhardened SAXParser in content-type detection leads to blind XXE / SSRF / billion-laughs DoS

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission or unauthenticated when the registry runs with default...

RHEL 10 : assertj-core (RHSA-2026:59372)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59372 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...