CVE-2026-82386 Apache Roller: XML external entity processing in OPML bookmark import

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity...

EUVD-2026-88130

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity...

CVE-2026-88828 Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or...

CVE-2026-88828

The Blacklist Manager for WooCommerce WordPress plugin, affecting versions 1.3.0 through 2.3.1 , contains a vulnerability where user blocking is not enforced across all authentication paths. Specifically, an account blocked by a site owner can continue to authenticate and maintain account privile...

CVE-2026-88828 Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or...

Uncontrolled Resource Consumption

jackson-databind is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the deserialization of arbitrarily long numeric components in XML datatype strings without length validation, which allows an unauthenticated attacker to submit specially crafted JSON values that caus...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-82384: Deserialization of Untrusted Data

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

expat security update

2.5.0-6.5 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 2.5.0-6.4 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002...

ALSA-2026:72448 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

ALSA-2026:72663 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

PT-2026-99790

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller bu...

CVE-2026-82377: Missing Authorization

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

PT-2026-99804

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An unauthenticated remote attacker can cause the deserialization of attacker-controlled bytes via the XML-RPC endpoint. This occurs because the endpoint accepts vendor extension types that are deserializ...

CVE-2026-82386: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity...

Important: resteasy-base

Issue Overview: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts...

CVE-2026-82376: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of fil...

PT-2026-108069

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 4.5.1-tuxcare.4...

Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...