Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

Citrix StoreFront - Cross-Site Scripting

Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow. id: CVE-2023-5914 info: name: Citrix StoreFront - Cross-Site Scripting author: DhiyaneshDK...

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

Apache OFBiz < 18.12.10 - Arbitrary Code Execution

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. id: CVE-2023-49070 info: name: Apache OFBiz 18.12.10 - Arbitrary Code Execution author: your3cho severity: critical description: | Pre-auth RCE in Apach...

EUVD-2026-107658

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...

glycin-loaders security update

An update is available for glycin-loaders. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Sandboxed and extendable image decoding. Security Fixes: librsvg:...

RLSA-2026:86331 Important: glycin-loaders security update

Sandboxed and extendable image decoding. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the...

librsvg2 security update

An update is available for librsvg2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The librsvg2 packages provide a Scalable Vector Graphics SVG library based ...

RLSA-2026:86841 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

librsvg2 security update

An update is available for librsvg2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The librsvg2 packages provide a Scalable Vector Graphics SVG library based o...

RLSA-2026:86921 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

librsvg2 security update

An update is available for librsvg2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The librsvg2 packages provide a Scalable Vector Graphics SVG library based o...

RLSA-2026:86842 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

expat security update

2.7.3-63 - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expatrealloc 2.7.3-62 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over- read in XMLParseBuffer 2.7.3-61 - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribu...

CVE-2026-76293

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...

CVE-2026-76293

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, an attacker with the edit_manager_xml capability can achieve Remote Code Execution (RCE) . The vulnerability exists because Splunk Web evaluates user-controlled expressions from Manager XML without sufficient syntax restrict...

CVE-2026-76293 Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...

CVE-2026-113284

A flaw was found in chromium-browser. A remote attacker could potentially execute arbitrary code inside the application's restricted sandbox environment by tricking a user into viewing a specially crafted HTML page. This issue is caused by memory corruption during the processing of Extensible...

CVE-2025-60595

CVE-2025-60595 SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site Arbitary code execution on the product owned by SPH Engineering. UGCS 5.13.0! Ardupilot/mavparse.py direct lines being Lines 230 "243: on the sph engineering...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...