CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

EUVD-2026-53300

In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...

CVE-2026-14304

The CVE describes an XML External Entity (XXE) vulnerability in Eclipse ACTF up to version 1.6.0 (including ACTF-based miChecker up to 3.1.0). The underlying issue allows an attacker to access local or internal network resources via applications that use Eclipse ACTF (e.g., miChecker). Affected c...

CVE-2026-6879

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. CVE-2026-55831: resource exhaustion/DoS in...

SUSE-SU-2026:3482-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed - CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. - CVE-2026-55831: resource exhaustion/DoS in...

Security Bulletin: IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

Summary IBM QRadar has an XML External Entity XXE injection vulnerability. This vulnerability is not exploitable in all configurations. All of the following conditions must be simultaneously true for a system to be at risk: 1 XML Property Autodetection must be actively enabled on at least one log...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig for Perl versions prior to 0.72 is vulnerable: verify() can return true without performing any digest or signature checks when multiple signatures are present or id_attr mismatch occurs, effectively bypassing signature verification. Affected range includes 0.29–0.71 (up to 0.28 is not af...

EUVD-2026-52325

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-18092

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...