CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2018-9144

creationtimestamp| type| source ---|---|--- 2026-08-11 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msreptbbnv2o...

CVE-2026-16626

Improper restriction of XML external entity reference vulnerability unauthenticated in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10...

SUSE-SU-2026:3560-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-3276: quadratic complexity in unicodedata.normalize can le...

CVE-2026-16626

Improper restriction of XML external entity reference vulnerability unauthenticated in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10...

CVE-2026-16626 JasperReports Server: XXE Injection Vulnerability (Unauthenticated)

Improper restriction of XML external entity reference vulnerability unauthenticated in Jaspersoft JasperReports Server. This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10...

CVE-2026-16626

CVE-2026-16626 affects JasperReports Server (9.0.0 before HF-9 and 10.0.0 before HF-10). The issue is an XML External Entity (XXE) restriction flaw in JasperReports Server, i.e., improper restriction of XML external entity references, leading to unauthenticated access. CVSSv4 base score 9.3 (crit...

CLSA-2026-1786373314 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.5...

SUSE-SU-2026:3548-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-3276: quadratic complexity in unicodedata.normalize can le...

CVE-2026-14860

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

Astra Linux – Vulnerability in libxml2

A flaw was discovered in the libxml2 library. This vulnerability arises from uncontrolled resource consumption when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this vulnerability by providing malicious catalogs,...

Astra Linux – Vulnerability in Firefox

DoS attack in the XML component. This vulnerability has been fixed in Firefox 149 and Thunderbird 149...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Prior to version 8.4.1, the XML Filter Query directive’s PropertyName was vulnerable to Boolean-based SQL injection. It seems that expression checking was bypassed by introducing double quote characters in PropertyName, allowing...

CVE-2026-14860

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-14860

The CVE-2026-14860 entry affects the Podcast Player WordPress plugin prior to version 8.3.1. The vulnerability is a server-side request forgery (SSRF) where input from users is used to build a server-side request, and the destination is not validated. This allows unauthenticated attackers to caus...

PT-2026-69884

Name of the Vulnerable Software and Affected Versions Jaspersoft JasperReports Server versions 9.0.0 through 9.0.0 before HF-9 Jaspersoft JasperReports Server versions 10.0.0 through 10.0.0 before HF-10 Description An unauthenticated user can exploit an improper restriction of XML external entity...

ROS-20260810-73-0003

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

ROS-20260810-73-0007

The vulnerability of the JAXP component in the Oracle Java SE software platform and the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to...

Photon OS 5.0: Libxml2 PHSA-2026-5.0-91-0874

An update of the libxml2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0874. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Expat PHSA-2026-5.0-91-0830

An update of the expat package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0830. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...