XML Entity Expansion

fast-xml-parser is vulnerable to XML Entity Expansion. The vulnerability is due to multiple DOCTYPE declarations repeatedly resetting entity-expansion limits during XML parsing, which allows an attacker to submit crafted XML that causes excessive CPU and memory consumption, event-loop blocking, a...

PT-2026-76450

These are all security issues fixed in the python313-pysaml2-7.5.4-1.1 package on the GA media of openSUSE Tumbleweed...

DoS (Denial of Service) at io.netty:netty-codec Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

SUSE CVE-2026-73569

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57472

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-73569

A flaw was found in fast-xml-parser. A remote attacker could exploit this by submitting a specially crafted XML document containing multiple DOCTYPE declarations. These repeated declarations can reset internal entity expansion limits during parsing. This can lead to excessive CPU usage, event-loo...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

EUVD-2026-58678

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57472

CVE-2026-57472 affects the KUNBUS RevPiPyLoad 0.11.0 XML-RPC management interface. A CWE-22 path traversal in the file management functionality enables a local unauthenticated attacker to delete arbitrary files with the RevPiPyLoad daemon privileges, leading to loss of configuration integrity and...

EUVD-2026-58677

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471

CVE-2026-57471 affects KUNBUS RevPiPyLoad 0.11.0 via the XML-RPC management interface. A path traversal flaw in the file management component allows a local unauthenticated attacker to read arbitrary files with the RevPiPyLoad daemon’s privileges by sending crafted requests to the local managemen...

CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-69101

Datavane TIS v5.0.0 is affected by an XXE injection via the doEditWorkflow endpoint. The issue arises because XML is parsed using an unhardened DocumentBuilderFactory with external entities and DTD loading enabled, enabling authenticated attackers to perform SSRF and out-of-band file exfiltration...

EUVD-2026-58668

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...