CVE-2026-89212

Akana API Platform contains an XML External Entity (XXE) vulnerability in its XML-to-JSON processing component, where external entity references were improperly restricted. This allows a remote, unauthenticated attacker to exploit the flaw over the network with low complexity, resulting in high c...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

RLSA-2026:66392 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library ...

RLSA-2026:66341 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection in plugin/AD_Server/VMAP.php, reachable without authentication when the AD_Server plugin is enabled. The timeOffset and idTag values from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter ...

CVE-2026-89247 WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

EUVD-2026-76059

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

ROOT-APP-NPM-CVE-2026-33036 CVE-2026-33036 in fast-xml-parser - Patched by Root

Root has patched CVE-2026-33036 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...

BIT-TOMCAT-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...

EUVD-2026-75878

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

PT-2026-89868

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging

A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML outpu...

org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

CVE-2026-2310

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310 IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-2310

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity Injection (XXE) flaw when processing XML data, as described by CWE-91 (XML Injection). A remote attacker with low privileges and a local attack vector can exploit this to expose sensitive information or consume memory ...

CVE-2026-19596

An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...

EUVD-2026-75725

An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...

CVE-2026-19596

An XML External Entity (XXE) vulnerability in the XML collector of OpenNMS Meridian and Horizon allows an attacker who can control the XML response collected by OpenNMS (e.g., via a compromised monitored host or HTTP man-in-the-middle) to read files accessible to the OpenNMS service account, incl...