CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1780578419)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1780578419 advisory. - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Note that Ness...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1779359397)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1779359397 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized craft...

Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc (crlsa-2026_18748)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202618748 advisory. libvirt: Denial of service in XML parsing CVE-2025-12748 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2020_4484)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204484 advisory. expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 expat: heap-based buffer over-read via...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2021_2584)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212584 advisory. ruby: Potential HTTP request smuggling in WEBrick CVE-2020-25613 ruby: XML round-trip vulnerability in REXML CVE-2021-28965 Tenable has extracted the...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1758022908)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758022908 advisory. - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many...

Linux Distros Unpatched Vulnerability : CVE-2026-92121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal inside signed content flag permanently set. The...

AlmaLinux 9.2 [TuxCare] Security Update: jsoup / jsoup-javadoc (ALMALINUX9.2:CLSA-2026:1784900402)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784900402 advisory. - jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable ...

Rocky Linux 10.2 [CIQ] Security Update: yggdrasil-worker-package-manager / etc Multiple Vulnerabilities (crlsa-2026_69099)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_69961)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2022_5799)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225799 advisory. golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705...

Oracle-WebLogic-CVE-2017-10271

Oracle-WebLogic-CVE-2017-10271 WebLogic wls-wsat RCE CVE-2017-10271 漏洞描述 早期，黑客利用WebLogic WLS 组件漏洞对企业服务器发起大范围远程攻击，有大量企业的服务器被攻陷，且被攻击企业数量呈现明显上升趋势，需要引起高度重视。其中，CVE-2017-3506是一个利用Oracle WebLogic中WLS 组件的远程代码执行漏洞，属于没有公开细节的野外利用漏洞，大量企业尚未及时安装补丁。官方在 2017 年 4 月份就发布了该漏洞的补丁。 CVE-2017-3506补丁说明： public...

CVE-2025-66034-htb-ctf

CVE-2025-66034-htb-ctf VariaType 可变字体生成器漏洞利用工具 此仓库包含针对 Hack The Box 上 VariaType 机器的专用漏洞利用工具。该漏洞利用利用了 fontTools 库或 Web 应用程序处理 .designspace XML 文件和元数据插值时的漏洞，以实现远程代码执行 RCE 。 📝 描述 该漏洞存在于字体生成过程中。通过构造恶意的 designspace 文件，我们可以将 PHP 反向 shell 载荷注入到字体的元数据中（特别是 字段）。当服务器处理这些文件以生成可变字体时，它会将输出写入用户定义的路径，从而允许我们将 .p...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

Important: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

expat: Expat: XML Injection via Malformed UTF-16 Input

A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enabl...

firefox: thunderbird: Use-after-free in the XML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

CVE-2026-103044

A flaw was found in the MediaWiki EasyTimeline extension. An Extensible Markup Language XML injection vulnerability exists due to improperly serving image map files as XML data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potentially...

OESA-2026-4177 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16...