CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

libxml2 security, bug fix, and enhancement update

An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fix Rocky Linux-11927...

EUVD-2026-84937

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

EUVD-2026-84961

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

PT-2026-97308

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 12.8.709 and earlier ManageEngine Firewall Analyzer versions 12.8.709 and earlier Description An XML Injection issue exists within the Rule Tracking Compare Policies feature. XML Injection occurs when an...

CVE-2026-86934: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Serv...

CVE-2026-76979: XML Injection (aka Blind XPath Injection)

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...

Linux Distros Unpatched Vulnerability : CVE-2026-91719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-95369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox v...

PT-2026-97424

Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 26.0.3 Description An authorization bypass exists in the FileMaker Server Web Publishing Engine. By including a forged X-FMI-PE-ExtendedPrivilege header in a request, an attacker can bypass the disabled Custo...

apr-util security update

1.6.1-9.1 - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolves...

CVE-2026-92001: Improper Restriction of Recursive Entity References in DTDs

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-78253: Uncontrolled Recursion

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

MiracleLinux 8 : libxml2-2.9.7-21.el8_10.8 (AXSA:2026-1887:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1887:09 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-92023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...

PT-2026-97258

Name of the Vulnerable Software and Affected Versions Apache Sling XSS versions prior to 2.4.12 Description Improper restriction of recursive entity references in Document Type Definitions DTDs, known as XML entity expansion, allows for potential resource exhaustion or denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-78253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion...

RockyLinux 8 : libxml2 (RLSA-2026:69655)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69655 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 f...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...