CVE-2026-109430

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

EUVD-2026-101808

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

CVE-2026-109430 Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

CVE-2026-109430 Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

CVE-2026-109430

Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XML External Entity (XXE) injection because the /WebAdvisor/WebAdvisor endpoint fails to disable external entity and DTD resolution. A remote attacker can submit crafted XML POST requests to trigger Server-Side Request Forgery (SSRF) , d...

JPEG XL vs AVIF for web use-cases

JPEG XL has now landed in all major browsers, so I figured I'd take a closer look at what it's good/bad at compared to other formats. Conclusions I'll go into full detail, with examples and benchmarks, but for those of you who don't have the time, here are the headlines: For lossy photos on the...

CLEANSTART-2026-UD62821 On Unix systems, opening a file in an os

CVE-2026-39822 affects multiple packages. On Unix systems, opening a file in an os. See references for individual vulnerability details...

CLEANSTART-2026-EM66119 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...

CVE-2025-22869 affects multiple packages. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. See references for...

CLEANSTART-2026-LB27311 On Unix platforms, when listing the contents of a directory using File

Security vulnerability affects the external-dns package. On Unix platforms, when listing the contents of a directory using File...

EUVD-2026-101742

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

EUVD-2026-101732

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

EUVD-2026-101713

FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...

CVE-2026-55480: Improper Link Resolution Before File Access

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/ .ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

CVE-2026-16437: Weak Password Recovery Mechanism for Forgotten Password

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-109430: Improper Restriction of XML External Entity Reference

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity XXE injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to forc...

UBUNTU-CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

UBUNTU-CVE-2026-95125

libming through 0.4.8 contains a heap buffer overflow in rreadc in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service...

UBUNTU-CVE-2026-110830

FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...

PT-2026-114816

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

dcm4che 5.35.0 StoreSCP Path Traversal

dcm4che version 5.35.0 StoreSCP contains a path traversal vulnerability that allows unauthenticated remote attackers to write DICOM files outside the configured storage directory via attacker-controlled DICOM attribute values. Advisory ID: SYSS-2026-077 Product: dcm4che Manufacturer: J4Care...