2381 matches found
PT-2026-68518
Name of the Vulnerable Software and Affected Versions APR-util versions prior to 1.6.4 Description A bug allows a stack recursion attack against any library consumer that parses XML from untrusted sources and utilizes the apr xml quote elem function. Recommendations Upgrade to version 1.6.4...
SUSE-SU-2026:3482-1 Security update for netty, netty-tcnative
This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed - CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. - CVE-2026-55831: resource exhaustion/DoS in...
JLSEC-2026-958 ImageMagick: MSL - Stack overflow in ProcessMSLScript
Summary Magick fails to check for circular references between two MSLs, leading to a stack overflow. Details After reading a.msl using magick, the following is displayed: MSLStartElement - ReadImage - ReadMSLImage - ProcessMSLScript - xmlParseChunk - xmlParseTryOrFinish - MSLStartElement bash...
Linux Distros Unpatched Vulnerability : CVE-2026-6879
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with ma...
CVE-2026-6879
Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...
ALPINE-CVE-2026-6879
Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...
CVE-2026-6879
Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...
@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)
fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: CVE-2026-73569 Source advisory: OSV:GHSA-8R6M-32JQ-JX6Q...
@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +30 more potentially affected by unknown CVE via fast-xml-parser (>=5.9.3, <=5.10.0)
fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =1.6.6, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =2.4.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-FASTXMLPARSER-18170229...
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...
Important: glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...
ALSA-2026:42090 Important: glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...
CVE-2026-13401
CVE-2026-13401 affects Perl’s XML::Bare up to version 0.53. The vulnerability is a hang/infinite loop in the attribute parser: the parserc_parse state cursor does not advance for certain malformed attribute forms (e.g., nameless attributes like ), causing looping. Impact is a potential denial-of-...
Alibaba Cloud Linux 3 : 0204: libxml2 (ALINUX3-SA-2026:0204)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0204 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-6170: A flaw was found in the interactive...
Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1910)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1910 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...
ALSA-2026:39878 Important: perl-XML-LibXML security update
This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fixes:...
Medium: python3.9
Issue Overview: The "tarfile" module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other...
Important: python3.12
Issue Overview: The "tarfile" module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other...
[SECURITY] Fedora 44 Update: mingw-expat-2.8.2-1.fc44
This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...
