Most recent entries from all

bdu:2026-03634

BELL-CVE-2026-24515

Affected: Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat

certfr-2026-avi-0122 — De multiples vulnérabilités ont été découvertes dans Tenable Nessus. Elles permettent à un attaquant de provoquer un pr…

certfr-2026-avi-0122

Withdrawn: CLEANSTART-2026-AF52025 — In libexpat before 2

Withdrawn by the publisher.

Affected: CleanStart: apache-zookeeper

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details.

EUVD-2026-323863

fkie_cve-2026-24515

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

GHSA-mpwv-4wmh-cvf7

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

ICSA-26-155-04 — Hitachi Energy RTU500

Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and integrity. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

OESA-2026-1272 — expat security update

Affected: openEuler:20.03-LTS-SP4: expat

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.(CVE-2026-24515)

openSUSE-SU-2026:10144-1 — expat-2.7.4-1.1 on GA media

expat-2.7.4-1.1 on GA media

SSA-253495 — SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corrup…

SUSE-SU-2026:0386-1 — Security update for expat

Security update for expat

UBUNTU-CVE-2026-24515

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: libxmltok, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver and 63 more

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

WID-SEC-W-2026-0213 — expat: Schwachstelle ermöglicht Denial of Service

Ein lokaler Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.