XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

PT-2026-61516

Name of the Vulnerable Software and Affected Versions Meshtastic versions prior to 2.7.21.1370b23 Description An insecure CI/CD workflow configuration in the main matrix.yml workflow allows arbitrary code execution. The workflow is triggered by pull request target and executes code from an...

OPENSUSE-SU-2026:21375-1 Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions bsc1268902. - CVE-2026-59889: missing view guard when deserializi...

EUVD-2026-45330

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

GO-2026-5937 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

oasdiff does not enforce --allow-external-refs=false on the git-revision load path SSRF / local file read in github.com/oasdiff/oasdiff...

CVE-2026-8859

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HT...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SVG sanitizer's handling of the href attribute, which restricts xlink:href on SVG...

EUVD-2026-45206

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The playfile functionality accepts user-controlled input through the soundpath parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying...

EUVD-2026-45180

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity XXE vulnerability...

Vulnerabilities in Adobe Experience Manager

Adobe has identified several vulnerabilities in Adobe Experience Manager. These vulnerabilities include an absence of authentication at a critical function, allowing unauthorized actions to occur without user interaction. Additionally, there is a Server-Side Request Forgery SSRF vulnerability tha...

SUSE CVE-2017-12620

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache...

CVE-2026-8396

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396 XXE in Netcad's NetGIS

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

EUVD-2026-45165

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396 XXE in Netcad's NetGIS

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2...

CVE-2026-8396

CVE-2026-8396 is an XML external entity (XXE) vulnerability in NetGIS from Netcad Software Inc. The issue arises from an improper restriction of XML external entity references, enabling Serialized Data External Linking. Affected products/versions: NetGIS 5.0.66 through before 7.2.2 (i.e., 5.0.66 ...