TencentOS Server 3: libxml2 (TSSA-2026:1213)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1213 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CLSA-2026-1792537548 Fix CVE(s): CVE-2025-7425

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

CVE-2026-88901

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901

The camel-smooks component in Apache Camel (versions 4.7.0 before 4.18.5 and 4.19.0 before 4.22.1) is vulnerable to XML External Entity (XXE) processing. The issue stems from the Woodstox SAX parser resolving external general/parameter entities and external DTDs by default, without the hardening ...

EUVD-2026-104206

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901 Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

PT-2026-117365

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-88901: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

Astra Linux - Vulnerability in libjdom1-java, libjdom2-java

A XXE vulnerability exists in SAXBuilder in JDOM through version 2.0.6, allowing attackers to cause a denial of service through a crafted HTTP request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libxml2 (UTSA-2026-130064)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130064 advisory. A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing...

CLSA-2026-1791551729 Fix CVE(s): CVE-2026-74860

SECURITY UPDATE: double free in the Python SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not drop the reference to each enumeration name after PyListSetItem in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

CLSA-2026-1791493216 Fix CVE(s): CVE-2026-74860

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

CLSA-2026-1791489916 Fix CVE(s): CVE-2026-74860

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

CLSA-2026-1791372460 libxml2: Fix of CVE-2026-74860

CVE-2026-74860: do not decref enumerated attribute value strings after adding them to the list in the Python SAX attributeDecl callback, preventing a double free...