https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:15:54.077669+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09700 bdu:2026-09700 2026-10-04T00:15:55.428511+00:00 bdu:2026-09700 https://cve.radiocsirt.org/vuln/bell-cve-2026-41066 BELL-CVE-2026-41066 2026-10-04T00:15:55.428554+00:00

Affected: Alpaquita:25: py3-lxml, Alpaquita:stream: py3-lxml

 https://cve.radiocsirt.org/vuln/brew-animdl-cve-2026-41066 BREW-animdl-CVE-2026-41066 — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-04T00:15:55.428585+00:00

Affected: Homebrew: animdl

### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.

### Patches lxml 6.1.0 changes the default to `resolve_entities='internal'`, thus disallowing local file access by default.

### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities='internal'` or `resolve_entities=False` disables the local file access.

### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291

The default option was changed to `resolve_entities='internal'` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-04T00:15:55.428618+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-04T00:15:55.428635+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-292930 EUVD-2026-292930 2026-10-04T00:15:55.428662+00:00 EUVD-2026-292930 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41066 fkie_cve-2026-41066 2026-10-04T00:15:55.428673+00:00

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-vfmq-68hx-4jfw GHSA-vfmq-68hx-4jfw — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-04T00:15:55.428695+00:00

Affected: PyPI: lxml

### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.

### Patches lxml 6.1.0 changes the default to `resolve_entities='internal'`, thus disallowing local file access by default.

### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities='internal'` or `resolve_entities=False` disables the local file access.

### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291

The default option was changed to `resolve_entities='internal'` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41066 msrc_CVE-2026-41066 — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-04T00:15:55.428721+00:00 msrc_CVE-2026-41066 https://cve.radiocsirt.org/vuln/oesa-2026-2008 OESA-2026-2008 — python-lxml security update 2026-10-04T00:15:55.428736+00:00

Affected: openEuler:24.03-LTS: python-lxml

\ Security Fix(es):

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.(CVE-2026-41066)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10596-1 openSUSE-SU-2026:10596-1 — python-lxml-doc-6.1.0-1.1 on GA media 2026-10-04T00:15:55.428757+00:00

python-lxml-doc-6.1.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-87 PYSEC-2026-87 2026-10-04T00:15:55.428771+00:00

Affected: PyPI: lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21587-1 SUSE-SU-2026:21587-1 — Security update for python-lxml 2026-10-04T00:15:55.428789+00:00

Security update for python-lxml

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41066 UBUNTU-CVE-2026-41066 2026-10-04T00:15:55.428802+00:00

Affected: Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:Pro:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml, Ubuntu:22.04:LTS: lxml, Ubuntu:24.04:LTS: lxml, Ubuntu:25.10: lxml, Ubuntu:26.04:LTS: lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1219 WID-SEC-W-2026-1219 — lxml: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-04T00:15:55.428830+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in lxml ausnutzen, um Informationen offenzulegen.