https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T11:13:03.271424+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-359326 EUVD-2026-359326 2026-10-07T11:13:03.327736+00:00 EUVD-2026-359326 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43955 fkie_cve-2025-43955 2026-10-07T11:13:03.327823+00:00

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath contexts.

 https://cve.radiocsirt.org/vuln/ghsa-mwx3-c2hq-28xw GHSA-mwx3-c2hq-28xw 2026-10-07T11:13:03.327859+00:00

TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs.