@3wks/gae-node-nestjs (>=0.1.0, <=6.0.0-rc.0), @adriantombu/vat-number (>=0.0.1, <=1.1.4) +509 more potentially affected by unknown CVE via xml-crypto (>=0.0.10, <=1.4.0)

xml-crypto NPM version =0.0.10, =0.1.0, =0.0.1, =0.6.1, =0.1.1, =0.16.9, =0.7.1, =2.0.4, =3.1.0-alpha.24, =0.0.1, =1.2.86, =4.0.0-116, =1.0.0, =1.0.4 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0201...

Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)

Summary This security vulnerability in the AssertJ library used within IBM Event Processing could allow an attacker to exploit specially crafted XML input to cause local file disclosure, server-side request forgery SSRF, or denial of service in Java-based components running on the Apache Flink...

Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)

Summary This security vulnerability in the AssertJ library used within IBM Event Processing could allow an attacker to exploit specially crafted XML input to cause local file disclosure, server-side request forgery SSRF, or denial of service in Java-based components running on the Apache Flink...

WS-2019-0405

bode-parse-xml package contains malicious code. The package uploads system information such as OS and hostname to a remote server...

WS-2016-7062

Security vulnerability found in plexus-utils before 3.0.24. XML injection found in XmlWriterUtil.java...

WS-2019-0237

samlify versions before 2.4.0 are vulnerable to Authentication Bypass when fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames...

WS-2019-0065

An XML eXternal Entity XXE Injection was discovered in pmml-model before version 1.4.3. A remote attacker can exploit this vulnerability by sending a request to submit malicious External Entity references within the embedded XML metadata to the target system...

Updated perl-XML-LibXML packages fix security vulnerability

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. CVE-2026-8177...

WS-2013-0012

XML signature wrapping attacks vulnerability In leifj pyXMLSecurity 7.0 before 0.9...

CVE-2026-8532: External Control of Assumed-Immutable Web Parameter

Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-8532

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

PT-2026-40962

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager affected versions not specified Description A flaw in the web UI of Cisco Catalyst SD-WAN Manager, previously known as SD-WAN vManage, allows an unauthenticated remote attacker to read arbitrary files from the...

PT-2026-41424

CVE-2026-40328 - Apache HTTP Server XML External Entity XXE Injection CVE ID :CVE-2026-40328 Published : May 13, 2026, 10:16 p.m. | 37 minutes ago Description :Rejected reason: This CVE is a duplicate of another CVE. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affect...

Cisco Catalyst SD-WAN Manager has a vulnerability in input validation.

Cisco Catalyst SD-WAN Manager is a highly customizable dashboard provided by the American company Cisco. It simplifies and automates the deployment, configuration, management, and operation of Cisco SD-WAN. There is an input validation vulnerability in Cisco Catalyst SD-WAN Manager, which stems...

Linux Distros Unpatched Vulnerability : CVE-2026-7210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash...

CVE-2026-44445

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity XXE reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive...

CVE-2026-44193

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restoreconfigsection fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7...

CVE-2026-44193 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restoreconfigsection fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7...

CVE-2026-44445

ERPNext contains an XXE (XML External Entity) vulnerability in the EDI Module that affects versions prior to 15.104.3 and 16.12.0. An authenticated attacker could read local filesystem files, including sensitive configuration files. The issue is fixed in 15.104.3 and 16.12.0. Impact is limited to...

CVE-2026-44445 ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity XXE reference vulnerability in the EDI Module enables an authenticated attacker to read files from the local file system, including sensitive...