61318 matches found
PT-2026-68274
Name of the Vulnerable Software and Affected Versions Jenkins XML Job to Job DSL Plugin versions prior to 0.1.14 Description The plugin fails to perform necessary permission checks, which allows users without the required privileges to trigger the conversion functionality. Recommendations Update...
CVE-2026-10025: Improper Restriction of XML External Entity Reference
IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...
XXE vulnerability in ivy-report
ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...
CVE-2026-70439: Missing Authorization
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...
CVE-2026-70448: Improper Restriction of XML External Entity Reference
Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...
CLSA-2026-1784856386 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1...
CLSA-2026-1781744139 TuxCare security update for fast-xml-parser (7 CVEs)
TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 4.4.0-tuxcare.1...
CLSA-2026-1781744124 TuxCare security update for fast-xml-parser (2 CVEs)
TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.17.5-tuxcare.1...
CLSA-2026-1781744131 TuxCare security update for fast-xml-parser (2 CVEs)
TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1...
CLSA-2026-1781744123 TuxCare security update for fast-xml-parser (2 CVEs)
TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.19.0-tuxcare.1...
CLSA-2026-1781744119 TuxCare security update for fast-xml-parser (6 CVEs)
TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.2.7-tuxcare.1...
CLSA-2026-1777336754 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.6-tuxcare.1...
CLSA-2026-1776818199 TuxCare security update for fast-xml-parser (4 CVEs)
TuxCare rebuilt fast-xml-parser to address 4 CVEs. Fixed in 4.5.3-tuxcare.2...
CLSA-2026-1774398086 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.3-tuxcare.1...
Security update for netty, netty-tcnative
This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. CVE-2026-55831: resource exhaustion/DoS in...
SUSE-SU-2026:3482-1 Security update for netty, netty-tcnative
This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed - CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp bsc1271435. - CVE-2026-55831: resource exhaustion/DoS in...
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
SummaryFramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...
PYSEC-2026-3584 Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Summary FramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...
datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
SummaryWhen generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...
