AlmaLinux 9.2 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (ALMALINUX9.2:CLSA-2025:1759411642)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759411642 advisory. - Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow...

AlmaLinux 9.2 [TuxCare] Security Update: libxslt / libxslt-devel (ALMALINUX9.2:CLSA-2025:1745587914)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745587914 advisory. - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but nev...

CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

UBUNTU-CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044 EasyTimeline should not serve image maps as application/xml

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044 EasyTimeline should not serve image maps as application/xml

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044

The MediaWiki - EasyTimeline extension is vulnerable to an XML injection (specifically blind XPath injection ) due to the improper serving of image map files as application/xml data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potenti...

CVE-2026-103044: XML Injection (aka Blind XPath Injection)

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

PT-2026-102932

Name of the Vulnerable Software and Affected Versions Mediawiki - EasyTimeline extension versions prior to 1.46.1 Mediawiki - EasyTimeline extension version 1.45.5 Mediawiki - EasyTimeline extension version 1.43.10 Description An XML injection issue, also known as blind XPath injection, exists in...

GeoServer RCE in Evaluating Property Name Expressions

In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expression...

Oracle Linux 8 : libxml2 (ELSA-2026-69655)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69655 advisory. 2.9.7-21.8 - Lower xpath recursion limits RHEL-249282 2.9.7-21.8 - Fix CVE-2026-6653 RHEL-215616 Tenable has extracted the preceding description block directly...

CVE-2026-76979: XML Injection (aka Blind XPath Injection)

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...

libxml2 security, bug fix, and enhancement update

2.9.7-21.8 - Lower xpath recursion limits RHEL-249282 2.9.7-21.8 - Fix CVE-2026-6653 RHEL-215616...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...

CVE-2026-65124: XML Injection (aka Blind XPath Injection)

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109800 advisory. Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many...

CVE-2026-11864

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864

IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 IF 001, 25.0.0 through 25.0.0 IF 005, 24.0.1 through 24.0.1 IF 008, and 24.0.0 through 24.0.0 IF 009 are affected by an XPath injection vulnerability. An authenticated attacker can use it to exfiltrate sensitive application data...