libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs...
CVE-2026-115506
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTol
#cwe-776
共收录 33 条相关情报。
← 返回所有主题** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache...
CVE-2026-108086
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vul
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Att...
CVE-2026-74030
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows
Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
CVE-2026-74030
Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. ...
CVE-2026-92001
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require...
CVE-2026-54077
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/quer
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted...
CVE-2026-58234
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nes
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions co...
CVE-2026-58234
SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nes
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authentic...
CVE-2026-16180
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 1
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with ...
CVE-2026-78681
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multi...
CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until
The XML and schema validation functionalities within the SchemaValidator Mediator process XML...
CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validatio
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows ...
CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validatio
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated ...
CVE-2026-14865
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML wi
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration pa
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 (...
CVE-2026-14979
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DO...
CVE-2026-14979
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
CVE-2026-54077
### Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to t
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser reso...
CVE-2026-45304
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.4
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to atta...
CVE-2026-45133
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.4