158 matches found
CVE-2026-17535: Out-of-bounds Read
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However...
JLSEC-2026-1238
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a...
Server-side Request Forgery (SSRF)
Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can bypass network...
The vulnerability of the YAML syntax analysis and parsing library js-yaml lies in the uncontrolled modification of object prototype attributes, allowing attackers to compromise the integrity of the protected information.
The vulnerability of the YAML parsing library js-yaml is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
The vulnerability of the YAML syntax analysis library lies in its uncontrolled recursion, which allows attackers to trigger a service failure.
The vulnerability of the YAML syntax analysis library is related to uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
UBUNTU-CVE-2026-51303
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
OESA-2026-3179 python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...
PT-2026-61808
Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...
perl-XML-LibXML security update
1:2.0132-3 - Fix out-of-bounds heap read via truncated UTF-8 in node name validation CVE-2026-8177 - Resolves: RHEL-186519...
ALSA-2026:39878 Important: perl-XML-LibXML security update
This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fixes:...
[SECURITY] Fedora 44 Update: mingw-expat-2.8.2-1.fc44
This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...
CVE-2026-54901
Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark arrayclass and hashclass references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse,...
EulerOS Virtualization 2.12.0 : libxml2 (EulerOS-SA-2026-2106)
According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveU...
SUSE CVE-2026-50219
libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,...
CVE-2026-26824
libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table MSAT in readMSAT is not fully initialized before being consumed by ole2validatesectorchain, which may result in application crashe...
The vulnerability of the libexpat XML file analysis library, related to the swapping of the zero pointer, allows an attacker to trigger a service failure.
The vulnerability of the libexpat library for analyzing XML files is related to the use of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...
OESA-2026-2187 uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89"ANSI C". uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party...
libXpm -- Out-of-bounds read in xpmNextWord()
The X.Org project reports: libXpm uses a number of internal helper functions to parse the XPM file format. One of these internal functions, xpmNextString, checks for the NULL terminator when looking for the end of the current string but not when looking for the beginning of the next string. A sma...
perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files
A flaw was found in XML::Parser, a Perl module for parsing XML. This vulnerability, an off-by-one heap buffer overflow, occurs when processing an XML file with very deep element nesting. A remote attacker could exploit this by providing a specially crafted XML file, potentially leading to memory...