CVE-2026-57074

A flaw was found in perl-XML-Bare. The parsercparse function, which handles XML parsing, contains an unbounded character lookahead vulnerability. A remote attacker could exploit this by providing a specially crafted, truncated XML string. This could cause the parser to attempt to read data beyond...

EUVD-2026-53542

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70448

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CLSA-2026-1784856386 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1...

CLSA-2026-1781744139 TuxCare security update for fast-xml-parser (7 CVEs)

TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 4.4.0-tuxcare.1...

CLSA-2026-1781744124 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.17.5-tuxcare.1...

CLSA-2026-1781744123 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.19.0-tuxcare.1...

CLSA-2026-1781744131 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1...

CLSA-2026-1781744119 TuxCare security update for fast-xml-parser (6 CVEs)

TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.2.7-tuxcare.1...

CLSA-2026-1777336754 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.6-tuxcare.1...

CLSA-2026-1776818199 TuxCare security update for fast-xml-parser (4 CVEs)

TuxCare rebuilt fast-xml-parser to address 4 CVEs. Fixed in 4.5.3-tuxcare.2...

CLSA-2026-1774398086 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.1...

Security Bulletin: Multiple Security vulnerabilities impacting watsonx.data integration

Summary Multiple Security vulnerabilities impacting watsonx.data integration. These vulnerabilities have been addressed and customers should update to version 5.3.1 at the earliest opportunity. Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time,...

Debian dsa-6404 : expat - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6404 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6404-1 [email protected] https://www.debian.org/securit...

CVE-2026-59728: XML Injection (aka Blind XPath Injection)

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

OESA-2026-3182 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by unknown CVE via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-FASTXMLPARSER-18170229...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can...