CVE-2026-92023

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-92023

A use-after-free vulnerability exists in the XML component of Firefox and Thunderbird . The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3, as documented in Mozilla security advisories (mfsa2026-...

EUVD-2026-78486

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

CVE-2026-92023 Use-after-free in the XML component

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-46490-samlify-SAML-Attribute-Injection

CVE-2026-46490 — samlify SAML AttributeValue XML 注入 → 权限提升 samlifyValue — 时被未经转义 地插入，因此普通用户可以向其自身、IdP签名 的 SAML 断言中注入额外的 元素（例如 role=admin）。由于注入发生在签名之前，服务提供商的签名检查通过，并会将伪造的属性视为权威属性。 | ---|--- CVE| CVE-2026-46490 公告| GHSA-34r5-q4jw-r36m 受影响| samlify rawXML = rawXML.replacenew RegExp"?\$t\, 'g',...

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service Mitigation To mitigate, avoid parsing...

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia: Ejecución Remota de Código RCE CVE-2026-34197 es una vulnerabilidad de ejecución remota de código RCE de alta severidad que afecta a Apache ActiveMQ Classic. El problema se encuentra dentro del puente Jolokia JMX-HTTP, que expone operaciones de gestión a...

CVE-2014-0195

Script de Explotación de Fuerza Bruta XML-RPC para WordPress Este repositorio contiene una prueba de concepto PoC basada en Python para realizar ataques de fuerza bruta a credenciales de inicio de sesión en instancias de WordPress vulnerables a CVE-2014-0195, donde la función system.multicall de...

CVE-2019-12401

CVE-2019-12401: Apache Solr 中的 XML 炸弹 5.0.0 之前的 Solr 版本容易受到通过其更新处理器的 XML 资源消耗攻击（即 Lol 炸弹）的影响。 通过利用 XML DOCTYPE 和 ENTITY 类型元素，攻击者可以创建一个模式，当服务器解析 XML 时该模式会扩展，导致内存溢出 OOM。 供应商披露： 供应商对该漏洞的披露和修复可以在此处找到。 概念验证： 更多细节和利用过程可以在这个PDF中找到。...

CVE-2019-14678

CVE-2019-14678: Entidad Externa XML en SAS XML Mapper SAS XML Mapper 9.45 tiene una vulnerabilidad de Entidad Externa XML XXE que puede ser aprovechada por atacantes malintencionados de múltiples maneras. Algunos ejemplos son la Lectura de Archivos Locales, la Exfiltración de Archivos Fuera de...

ActiveMQ-CVE-2023-46604

Validador Seguro de CVE-2023-46604 para ActiveMQ Un validador de un solo archivo y no destructivo para Apache ActiveMQ CVE-2023-46604. Inicia su propio servidor de callback HTTP, genera XML de Spring específico para el objetivo en memoria, envía el paquete OpenWire manipulado, correlaciona los...

CVE-2023-4357-Exploitation

CVE-2023-4357-漏洞利用 网络安全项目 描述 Google Chrome 116.0.5845.96之前版本中对XML中不可信输入的验证不足，允许远程攻击者通过特制的HTML页面绕过文件访问限制。 复现 设置环境 在Linux上下载Chrome root@kitploit: $ wget https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/114.0.5735.90/linux64/chrome-linux64.zip $ unzip chrome-linux64.zip 执行 root@kitploit: ...

EUVD-2026-78206

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...

EUVD-2026-78159

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...