EUVD-2026-36242

Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures. Versions prior ro 1.5.4 do not safely serialize scalar XML element values containing...

CVE-2026-53723 guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures. Versions prior ro 1.5.4 do not safely serialize scalar XML element values containing...

cn.com.mooho:base (1.3.29.8), cn.openapis:hy.microservice (>=1.0.0, <=1.21.0) +169 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=3.1.0, <=3.1.8)

org.springframework.ws:spring-xml MAVEN version =3.1.0, =1.0.0, =0.0.1, =0.0.1, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =2022.04.001, =2022.04.001, =2023.01.001 and more Source cves: CVE-2026-40998 Source advisory: GHSA-2MPF-M756-HXJM...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +91 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.0.0, <=4.0.17)

org.springframework.ws:spring-xml MAVEN version =4.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-40998 Source advisory: GHSA-2MPF-M756-HXJM...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: GHSA-2MPF-M756-HXJM...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +36 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-xml MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent 5.0.0-m1 - org.citrusframework:citrus-core...

cn.com.mooho:base (1.3.29.8), cn.openapis:hy.microservice (>=1.0.0, <=1.21.0) +169 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=3.1.0, <=3.1.8)

org.springframework.ws:spring-xml MAVEN version =3.1.0, =1.0.0, =0.0.1, =0.0.1, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =3.1.2, =2022.04.001, =2022.04.001, =2023.01.001 and more Source cves: CVE-2026-40998 Source advisory: OSV:GHSA-2MPF-M756-HXJM...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: OSV:GHSA-2MPF-M756-HXJM...

br.com.archbase:archbase-annotation-processor (>=1.0.1, <=1.0.31), br.com.archbase:archbase-app-framework (>=1.0.1, <=1.0.31) +91 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.0.0, <=4.0.17)

org.springframework.ws:spring-xml MAVEN version =4.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2026-40998 Source advisory: OSV:GHSA-2MPF-M756-HXJM...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +36 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-xml MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent 5.0.0-m1 - org.citrusframework:citrus-core...

Vulnerabilities in Adobe ColdFusion

Adobe has addressed several vulnerabilities in Adobe ColdFusion versions 2023.19, 2025.8, and earlier versions. These vulnerabilities include improper input validation, which allows arbitrary code to be executed without user interaction. There is also a path traversal vulnerability that enables...

CVE-2026-40998 Jaxp13 XPath XXE via StreamSource and SAXSource

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted...

EUVD-2026-36208

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +73 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-xml MAVEN version =4.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-40998 Source advisory: MEND:CVE-2026-40998...

CVE-2026-40998 Jaxp13 XPath XXE via StreamSource and SAXSource

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted...

cn.openapis:hy.microservice (>=1.21.9, <=1.22.8), com.github.salilvnair:api-processor (1.0.6) +36 more potentially affected by CVE-2026-40998 via org.springframework.ws:spring-xml (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-xml MAVEN version =5.0.0, =1.21.9, =2.0.8, =8.9.0-alpha3, =1.0.0, =5.0.0-beta.1, =1.4.66, =4.19.0, =4.19.0, =8.0.0-rc1, =8.0.0-rc5 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent 5.0.0-m1 - org.citrusframework:citrus-core...

[SECURITY] Fedora 43 Update: xmlstarlet-1.6.1-30.fc43

XMLStarlet is a set of command line utilities which can be used to transform, query, validate, and edit XML documents and files using simple set of shell commands in similar way it is done for plain text files using UNIX grep, sed, awk, diff, patch, join, etc commands...

Guzzle Services: Input validation vulnerability

Guzzle Services is an open-source client tool built on service descriptions for making HTTP requests. Prior to version 1.5.4 of Guzzle Services, there was a vulnerability related to input validation errors. This vulnerability occurred when the XML request serializer used XMLWriter::writeCData$val...

Cloud Foundry UAA and CloudFoundry CF Deployment: Data Fabrication Vulnerabilities

Cloud Foundry UAA is an identity verification and management service terminal developed by the Cloud Foundry Foundation in the United States, and it is used on the CloudFoundry platform. CloudFoundry CF Deployment is a code deployment component provided by the Cloud Foundry Foundation. Versions o...

PT-2026-48733

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions 2.0.0 through 78.13.0 Cloud Foundry CF Deployment versions prior to 56.1.0 Description Cloud Foundry UAA incorrectly treats XML encryption to the Service Provider as a substitute for XML signatures from the Identity...