CVE-2026-45186: Inefficient Algorithmic Complexity

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...

PHP security vulnerabilities

PHP is an open-source scripting language executed on the server side. Versions of PHP prior to 8.4.21 and 8.5.6 contained security vulnerabilities. These vulnerabilities stemmed from the DOMNode::C14N method, which might improperly handle XML data, causing a circular linked list to be formed in t...

openSUSE 16 Security Update : log4cxx (openSUSE-SU-2026:20705-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20705-1 advisory. Changes in log4cxx: - update to 1.7.0 bsc1261994, CVE-2026-40023: Non-ascii characters incorrectly encoded in JSON output 615 XML output could contain...

Exploit for CVE-2020-1938

Ghostcat - CVE-2020-1938 Exploit Lee archivos del Tomcat via AJP...

CVE-2025-69691

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.execphp. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code...

Unity Linux 20.1060e / 20.1070e Security Update: expat (UTSA-2026-017357)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017357 advisory. lookup in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow. Tenable has extracted the preceding description block directly from the Unity Linux...

EUVD-2026-28839

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory...

CVE-2026-42212 SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory...

CVE-2026-42212

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory...

CVE-2026-42212 SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .vmid file from the same directory...

CVE-2026-41936

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

NPM: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

NPM: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes vulnerability discovered by ? in WordPress Npm fast-xml-builder versions = 1.1.6...

GHSA-5WM8-GMM8-39J9 fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

Summary When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. Detail Malicious Input a: "@attr": '" onClick="alert1' Output x...

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

Summary When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. Detail Malicious Input a: "@attr": '" onClick="alert1' Output x...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection while processing XML entities. An attacker can inject arbitrary attributes into generated XML or HTML by crafting attribute values containing quotes, which are improperly parsed and split into multiple...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

NPM: fast-xml-builder Comment Value regex can be bypassed

NPM: fast-xml-builder Comment Value regex can be bypassed vulnerability discovered by ? in WordPress Npm fast-xml-builder versions 1.1.5...

XML Injection

Overview Affected versions of this package are vulnerable to XML Injection due to the incomplete sanitization of XML comments. An attacker can inject arbitrary XML or HTML content by including three consecutive dashes in the comment value. Note: This issue was introduced by the fix for...