CVE-2026-95369

An inappropriate implementation flaw was found in the XML component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513049042...

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

GHSA-XM28-XVQC-GXXG Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1,...

CVE-2026-104455

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...

PT-2026-104265

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...

openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...

PT-2026-105552

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

CVE-2026-73857

GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer...

Rocky Linux 10.2 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel Multiple Vulnerabilities (crlsa-2026_74001)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674001 advisory. expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input...

UBUNTU-CVE-2026-73857

GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer...

PT-2026-105986

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

CVE-2026-104455: Exposure of Sensitive Information to an Unauthorized Actor

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: Expat:...

RLSA-2026:74001 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-66046 expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-93990 For more details about the security issues, including the impact, a...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...