60942 matches found
UBUNTU-CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...
CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...
ANT-2026-5BD488PV · graphicsmagick · Stack-buffer-overflow
stack-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-5BD488PV: Stack-buffer-overflow in locale.c:257...
SUSE-SU-2026:3641-1 Security update for go1.26
This update for go1.26 fixes the following issues: Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalatio...
Security update for go1.25
This update for go1.25 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...
SUSE-SU-2026:3640-1 Security update for go1.25
This update for go1.25 fixes the following issues: Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalatio...
XML External Entity (XXE)
Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...
expat2 -- Inefficient Algorithmic Complexity
https://github.com/libexpat/libexpat/pull/1321 reports: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear sca...
PT-2026-77055
Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4 Description A denial of service issue exists due to quadratic algorithmic complexity within the storeAtts function in xmlparse.c. When processing N specified attributes with non-normalized values, the system...
Linux Distros Unpatched Vulnerability : CVE-2026-15803
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...
CVE-2026-50645 vulnerabilities
Vulnerabilities for packages: apache-tika-fips, wso2is, apache-tika...
CVE-2026-71979
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
CVE-2026-71979
INDI indiserver through 2.2.4.2 has a stack buffer overflow in MsgQueue.cpp triggered by unauthenticated remote attackers sending a single TCP packet on port 7624 with malformed XML tags exceeding 1024 bytes, causing an unbounded sprintf() write and daemon crash. Fixed in commit 96bbd7f. No in-th...
CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
EUVD-2026-60310
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
CVE-2026-71979
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...