CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

OESA-2026-3182 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-3180 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

HPESBNW05085 rev.1 - HPE Unified Correlation Analyzer (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity, XML External Entity XXE; Remote: Compromise of System Integrity, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Correlation Analyzer UCA All versions prior to 4.4.11 CVSS Scores:...

Updated apache packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...

DEBIAN-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

UBUNTU-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-15037 XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

EUVD-2026-48254

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-15037

CVE-2026-15037 affects Qt XML (QDom): improper output neutralization in comment, CDATA, and processing-instruction serialization from Qt 4.0.0 through 6.11. Untrusted text serialized into these nodes can inject arbitrary XML markup because node terminators aren’t escaped under the default Invalid...

CVE-2026-65754

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65754

CVE-2026-65754 concerns Joomla Extension RegularLabs ReReplacer Pro, with insecure path handling: ReReplacer XML include paths could read files outside the site directory. The CVSS 3.1 vector indicates network attack, low complexity, no user interaction, with high confidentiality impact and no in...

EUVD-2026-47908

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

GHSA-4QHR-G3C6-FCFX Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a...

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

Any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a...

OPENSUSE-SU-2026:21435-1 Security update for perl-XML-Bare

This update for perl-XML-Bare fixes the following issues: Changes in perl-XML-Bare: - CVE-2026-13401: XML:Bare would hang when parsing malformed attributes bsc1271640 - CVE-2026-57074: Fixed unbounded character lookahead bsc1271637...

SUSE CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-14865

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

CVE-2026-14865

In Progress Telerik UI for AJAX (older than v2026.2.708), the internal LayoutBuilder processes client-state XML without disabling DTD processing, enabling unauthenticated denial of service via recursive XML entity expansion. The vulnerability affects the UI component handling client-state XML; af...