EUVD-2026-78082

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2026-13107

IBM Business Automation Workflow (containers and traditional) versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, and 26.0.0-IF001 may use programming model artifacts in Advanced custom applications that are vulnerable to XML External Entity (XXE) injection by default (CWE-611). A remote authentic...

CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2026-13107: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

PT-2026-91461

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow affected versions not specified Description Programming model artifacts in both containerized and traditional deployments may be susceptible to XML Entity Injection attacks by default. This occurs when an...

EUVD-2026-76153

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-16180 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities...

EUVD-2026-71490

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities...

CVE-2026-16180

CVE-2026-16180 affects IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. The vulnerability resides in the Toolkit component, where an authenticated user can trigger a denial-of-service condition...

Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

Summary In addition to updating many operating system level packages, the following security vulnerabilities are addressed with IBM Business Automation Workflow released in August 2026.. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM CICS Transaction Gateway for Multiplatforms 9.1,...

Apicurio/apicurio-registry: apicurio-registry: XML entity-expansion denial of service via internal DTD subset

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURESECUREPROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloa...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the raw xml.etree.ElementTree parsing in...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

PYSEC-2026-3748

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

DEBIAN-CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-78681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft X...

EulerOS Virtualization 2.13.0 : python-lxml (EulerOS-SA-2026-3230)

According to the versions of the python-lxml packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the...