CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-75140 jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-76 / ESA-2026-77 / ESA-2026-118 / ESA-2026-119 / ESA-2026-133)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-76, ESA-2026-77, ESA-2026-118, ESA-2026-119, and ESA-2026-133 advisories. - Uncontrolled Recursion CWE-6...

PT-2026-79263

Name of the Vulnerable Software and Affected Versions langchain-community affected versions not specified Description The SitemapLoader.parse sitemap function in langchain community/document loaders/sitemap.py fails to apply the restrict to same domain control to nested sitemap entries. While lea...

PT-2026-79054

Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.23.2 Description An uncontrolled resource consumption issue exists in the XmlTreeBuilder function. A remote attacker can exhaust JVM heap memory by providing a deeply nested XML document containing uniquely-namespaced...

CVE-2026-18140

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

WordPress Nested Pages plugin < 3.2.15 - Editor+ Stored XSS via Post Title vulnerability

Editor+ Stored XSS via Post Title vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Nested Pages versions 3.2.15...

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

SummaryCVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates.The sanitizer only processes top-level stri...

PYSEC-2026-3666 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

Eclipse OpenJ9 versions up to 0.60 are vulnerable to a segmentation fault triggered by a crafted .class file containing deeply nested annotations. The root cause is improper handling of annotation nesting depth during class file processing, leading to a crash and denial of service . The CVSS 4.0 ...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

CVE-2026-16440

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

EUVD-2026-62368

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

BIT-ELASTICSEARCH-2026-72647 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...

Linux Distros Unpatched Vulnerability : CVE-2026-69220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1,...

PT-2026-78323

Name of the Vulnerable Software and Affected Versions Eclipse OpenJ9 versions prior to 0.61 Description A crafted .class file containing deeply nested annotations can trigger a segmentation fault, which is a specific type of crash that occurs when a program attempts to access a memory location th...

CVE-2026-72279

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. KVM on arm64 architectures incorrectly maps the L1 Virtual Nested Control Register VNCR into the host stage-1, failing to respect read-only memory regions. This could allow a malicious guest to write to a...