EulerOS Virtualization 2.13.1 : python-lxml (EulerOS-SA-2026-3190)

According to the versions of the python-lxml packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the...

EulerOS Virtualization 2.13.1 : expat (EulerOS-SA-2026-3171)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately...

CVE-2026-19851: Use of Default Password

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

ALSA-2026:59372 Moderate: assertj-core security update

A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 For more details about the security issues, including the impact, a...

CVE-2026-13401

A flaw was found in perl-XML-Bare. A remote attacker can exploit this vulnerability by providing specially crafted XML input with malformed attributes. This can cause the parsercparse function to enter an infinite loop, leading to a Denial of Service DoS condition where the application becomes...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

K000163048: Spring web services vulnerability CVE-2026-40998

Security Advisory Description Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

BIT-AUTHENTIK-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

The vulnerability of the XML component in the Firefox web browser allows a hacker to trigger a service failure.

The vulnerability of the XML component in the Firefox web browser is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

RHEL 9 : assertj-core (RHSA-2026:58949)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58949 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

RHEL 9 : assertj-core (RHSA-2026:58956)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58956 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

RHEL 9 : assertj-core (RHSA-2026:58957)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58957 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

PT-2026-79842

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME LINK or EMAIL LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via path handling in FramenetCorpusReader and NKJPCorpusReader. An attacker can read and parse arbitrary...

GHSA-QP76-PQ9F-GR9M Duplicate Advisory: Stable FrameNet and NKJP readers parse outside-root XML in 3.9.4

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-568f-pv23-39p4. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that...

Duplicate Advisory: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f833-7jw8-xwrv. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to...

GHSA-QQ3H-CGJ8-W3FX Duplicate Advisory: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f833-7jw8-xwrv. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to...

Duplicate Advisory: Stable FrameNet and NKJP readers parse outside-root XML in 3.9.4

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-568f-pv23-39p4. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that...