Security update for python313

This update for python313 fixes the following issues: CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. CVE-2026-0864: improper handling of...

PT-2026-78521

Name of the Vulnerable Software and Affected Versions Cisco BroadWorks affected versions not specified Description An issue in the Open Client Interface OCI XML Parser allows an unauthenticated remote attacker to read sensitive configuration information. This occurs because the parser improperly...

UBUNTU-CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099480)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099480 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099458 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can...

CVE-2026-73569

A flaw was found in fast-xml-parser. A remote attacker could exploit this by submitting a specially crafted XML document containing multiple DOCTYPE declarations. These repeated declarations can reset internal entity expansion limits during parsing. This can lead to excessive CPU usage, event-loo...

Linux Distros Unpatched Vulnerability : CVE-2026-73569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.j...

UBUNTU-CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

DEBIAN-CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

UBUNTU-CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-73569

CVE-2026-73569 affects fast-xml-parser (OrderedObjParser.js). When parsing a single XML with multiple DOCTYPE declarations (versions 5.9.3–5.10.1), addInputEntities() repeatedly resets entity-expansion limits, allowing repeated resets within one parse. This can cause excessive CPU use, event-loop...

EUVD-2026-58184

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

ROS-20260813-73-0055

The vulnerability in perl-XML-Parser is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

CVE-2026-73235

Summary (CVE-2026-73235) FreeCAD prior to 1.1.2 is affected by an XML External Entity (XXE) vulnerability in the Xerces SAX2 XMLReader used by Base::XMLReader::XMLReader(), which parses attacker-controlled Document.xml from crafted .FCStd archives. If default external entity resolution and extern...

CVE-2026-73235

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity...