encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service Mitigation To mitigate, avoid parsing...

Chromium CVE-2026-87636: Type confusion in XML

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-78206

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...

EUVD-2026-78159

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

PT-2026-91959

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Firefox ESR versions prior to 115.41 Firefox ESR versions prior to 140.16 Firefox ESR versions prior to 153.3 Thunderbird versions prior to 156 Thunderbird versions prior to 140.16 Thunderbird versions prior to...

CVE-2026-92023: Use After Free

Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

CVE-2026-83300: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite component: Install. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks...

PT-2026-93137

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Code injection in XML allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact...

CVE-2026-83352: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite component: Install. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks...

CVE-2026-11864: Improper Neutralization of Data within XPath Expressions

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-12666: Improper Restriction of XML External Entity Reference

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a...

ROS-20260915-73-0041

The vulnerability of XML components in Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created XML file...

ROS-20260915-73-0018

The vulnerability of XML components in Google Chrome and Microsoft Edge relates to the exploitation of xml blind xpath injection. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and influence the integrity of data through a specially created XML file...

ROS-20260915-73-0002

The vulnerability of XML components in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a speciall...

CVE-2026-76859: Insufficiently Protected Credentials

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...

CVE-2026-91719: Improper Control of Generation of Code

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-83345: Uncontrolled Resource Consumption

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite component: Install. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle XML Gateway. Successful attacks...