Batik SVG color-profile xml:base bypasses same-origin checks (CVE-2026-49236)
Apache rates the Batik external-resource bypass moderate; the oss-security note does not list versions or a fix.
Stories per day · 30 days
2 RSS
Relatedchrome6google6zero-day6use-after-free5apache3xxe3batik2apache-abdera1apache-camel1apache-cocoon1atom1camel-saxon1cwe-4761gpac1imagemagick1information-disclosure1memory-leak1mp4box1
20 stories, newest first · one card per story
Stories tagged #xml
Google patches exploited Chrome zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
Google patches in-the-wild Chrome XML zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 close nine flaws; Google has not confirmed code execution or named attackers.
Google fixes exploited Chrome XML use-after-free zero-day CVE-2026-125350
Stable builds 157.0.8103.50/.51 close the high-severity bug; Google is withholding details until most users update.
ImageMagick leaks XMP parameter-entity strings (CVE-2026-116155)
Fixed in ImageMagick 7.1.2-33 and 6.9.13-58; reject XMP profiles in policy.xml as a stopgap.
GPAC MP4Box NULL dereference via crafted XML (CVE-2025-60487)
gf_isom_get_esd() crashes on near-NULL; fixed in commit e6d01820, CVSS 6.2.
Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
Apache Abdera XXE in Atom parsing (CVE-2026-113582)
All Apache Abdera versions are affected and unsupported; CVSS 4.0 is 8.7 with high confidentiality impact.
Apache Cocoon XEE flaw can enable SSRF and file disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
Apache CXF adds default XML element and character limits to stop oversized documents exhausting memory.
USN-8897-1: lxml vulnerabilities
Ubuntu fixes lxml flaws that can bypass URL sanitization for XSS and leak local files via untrusted XML.
USN-8891-1: librsvg vulnerability
Ubuntu reports a librsvg flaw that may allow denial of service or arbitrary code execution.
libexpat 2.9.0 fixes two vulnerabilities
libexpat 2.9.0 patches CVE-2026-77214 and CVE-2026-102633, including a 32-bit integer overflow.
CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Apache Camel Quarkus CVE-2026-88789 forces Xalan and drops external DTD and stylesheet hardening.
USN-8813-1: Expat vulnerabilities
Ubuntu's USN-8813-1 patches Expat flaws that can crash the parser or allow code execution.
CVE-2026-92001: Apache Sling XSS: Missing parser resource limits
Apache Sling XSS before 2.4.12 has an XML entity expansion vulnerability (CVE-2026-92001).
SAML: A fractal of bad design
Security research argues SAML is a legacy protocol with fundamental design flaws and should be deprecated for OpenID Connect.
2
libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling)
libexpat 2.8.5 fixes CVE-2026-93990 by rejecting malformed UTF-16 that could be smuggled into applications.
USN-8787-1: libxml2 vulnerabilities
Ubuntu patched libxml2 flaws that could crash the library, enable code execution, or cause denial of service.
Vulnerabilities fixed in libxml2-2.15.4
libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.