https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:48:56 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/cleanstart-2026-ce10526 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: renovate</p> <p>Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: renovate</p> <p>Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ce10526 https://cve.radiocsirt.org/vuln/euvd-2026-329289 EUVD-2026-329289 https://cve.radiocsirt.org/vuln/euvd-2026-329289 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27942 <p>fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> <p>fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27942 https://cve.radiocsirt.org/vuln/ghsa-fj3w-jwp8-x2g3 <p><strong>Affected:</strong> npm: fast-xml-parser</p> <p>### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input</p> <p>``` [{ &#39;foo&#39;: [ { &#39;bar&#39;: [{ &#39;@_V&#39;: &#39;baz&#39; }] } ] }] ```</p> <p>Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_</p> <p>### Patches Yes in 5.3.8</p> <p>### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> <p>### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)</p> <p><strong>Affected:</strong> npm: fast-xml-parser</p> <p>### Impact Application crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar input</p> <p>``` [{ &#39;foo&#39;: [ { &#39;bar&#39;: [{ &#39;@_V&#39;: &#39;baz&#39; }] } ] }] ```</p> <p>Cause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content. _What kind of vulnerability is it? Who is impacted?_</p> <p>### Patches Yes in 5.3.8</p> <p>### Workarounds Use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> <p>### References [_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)</p> https://cve.radiocsirt.org/vuln/ghsa-fj3w-jwp8-x2g3 https://cve.radiocsirt.org/vuln/rhsa-2026:12277 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> https://cve.radiocsirt.org/vuln/rhsa-2026:12277 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27942 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-webfont, Ubuntu:25.10: node-webfont, Ubuntu:26.04:LTS: node-webfont</p> <p>fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-webfont, Ubuntu:25.10: node-webfont, Ubuntu:26.04:LTS: node-webfont</p> <p>fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27942