CVE-2026-56131

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XMLResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service. Mitigation To mitigate this vulnerability, avoid...

EUVD-2026-51358

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...

EUVD-2026-51341

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over...

RHEL 10 : libsolv (RHSA-2026:48818)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48818 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv:...

CVE-2026-66369

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap...

CVE-2026-17943

An inappropriate implementation flaw was found in the Parser component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514424283...

CVE-2026-66369

The CVE-2026-66369 issue affects the GOOSE parser in the libiec61850 library used by MZ Automation. It is caused by an off-by-one boundary-handling flaw in the parser that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus, causing the parser to advance its in...

CVE-2026-66364

CVE-2026-66364 affects the GOOSE payload parser (notably in the libiec61850/GOOSE implementation referenced by MZ Automation). The root cause is a boundary handling flaw: during processing of certain payload fields, an attacker-controlled inner element length may exceed its enclosing length, caus...

CVE-2026-66364 MZ Automation libiec61850 Out-of-bounds Read

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

UBUNTU-CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

SUSE CVE-2026-17943

Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23985

CVE-2026-23985 is a ReDoS vulnerability in Apache Superset versions 1.5.0–5.0.0, arising from the sql_parse.py component’s integration with the sqlparse library. The issue centers on the SQL_REGEX used to parse SQL statements, where overlapping disjunctions share a common outer quantifier, enabli...

JLSEC-2026-1032 ImageMagick: Memory Leak in wand option parser when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25...

CVE-2026-48910 Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...

CVE-2026-48910

CVE-2026-48910 affects Apache JSPWiki up to version 2.12.3, where the Markdown parser can trigger an XSS when parsing errors in the markdown renderer. This could allow an attacker to execute JavaScript in a victim’s browser and potentially access sensitive information. The advisory recommends upg...