CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-82877

ILIAS eLearning versions before 9.22, 10.0–10.9, and 11.0–11.2 are affected by an arbitrary file read vulnerability in the SOAP addFile method. The root cause is that crafted XML with COPY-mode imports allows an unsandboxed import directory to be abused into constructing absolute file paths. Auth...

CVE-2026-82669

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

RHSA-2026:61247 Red Hat Security Advisory: libxml2 security update

Bulletin has no description...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

EUVD-2026-68453

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82669

klaussilveira GitList 2.0.0 is affected by a denial of service vulnerability in the XML Parsing component, specifically the SimpleXMLElement function in src/SCM/System/Git/CommandLine.php. A remote attacker can trigger the flaw with low complexity and no authentication, causing partial availabili...

CVE-2026-62385

A flaw was found in NLTK. This path traversal vulnerability, located in the FramenetCorpusReader and NKJPCorpusReader components, allows an attacker to read arbitrary XML files accessible to the application. This can be achieved by supplying unsafe selectors or poisoned index state, exploiting...

libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service DoS, making the affected system or application...

Low: python3.12

Issue Overview: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff. CVE-2026-18503 Element.findall and fully-consumed Element.iterfind exhibit On^2 time...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via...

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

Low: python3.11

Issue Overview: Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff. CVE-2026-18503 Element.findall and fully-consumed Element.iterfind exhibit On^2 time...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

CVE-2026-82669: Improper Resource Shutdown or Release

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

PT-2026-83772

Name of the Vulnerable Software and Affected Versions klaussilveira GitList version 2.0.0 Description A remote denial of service can be triggered through the XML Parsing component. The issue resides in the SimpleXMLElement function within the src/SCM/System/Git/CommandLine.php file. Recommendatio...

Linux Distros Unpatched Vulnerability : CVE-2025-71346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the...