Most recent entries from all

Withdrawn: CLEANSTART-2026-IA43044 — Security fixes for CVE-2020-8908, CVE-2022-42889, CVE-2023-2976, CVE-2024-25710, CVE-2024-26308, CVE-2024-29371, CVE-20…

Withdrawn by the publisher.

Affected: CleanStart: strimzi-kafka-operator

Multiple security vulnerabilities affect the strimzi-kafka-operator package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-255366

fkie_cve-2024-31573

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

GHSA-chfm-68vv-pvw5 — XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets

Affected: Maven: org.xmlunit:xmlunit-core

### Impact When performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.

## Patches Users are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b

### Workarounds XMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.

Users running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX `TransformerFactory` with extension functions disabled via features and attributes. The required `setFactory` or `setTransformerFactory` methods have been available since XMLUnit for Java 2.0.0.

### References [Bug Report](https://github.com/xmlunit/xmlunit/issues/264) [JAXP Security Guide](https://docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html#GUID-E345AA09-801E-4B95-B83D-7F0C452538AA)

gsd-2024-31573

msrc_CVE-2024-31573 — XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (u…

msrc_CVE-2024-31573

OESA-2025-1966 — xmlunit security update

Affected: openEuler:22.03-LTS-SP4: xmlunit

Security Fix(es):

A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)

UBUNTU-CVE-2024-31573

Affected: Ubuntu:16.04:LTS: xmlunit, Ubuntu:18.04:LTS: xmlunit, Ubuntu:20.04:LTS: xmlunit, Ubuntu:22.04:LTS: xmlunit, Ubuntu:24.04:LTS: xmlunit, Ubuntu:25.10: xmlunit, Ubuntu:26.04:LTS: xmlunit

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

WID-SEC-W-2026-1203 — Oracle Fusion Middleware: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.