https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:10:47 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09700 bdu:2026-09700 https://cve.radiocsirt.org/vuln/bdu:2026-09700 https://cve.radiocsirt.org/vuln/bell-cve-2026-41066 <p><strong>Affected:</strong> Alpaquita:25: py3-lxml, Alpaquita:stream: py3-lxml</p> <p><strong>Affected:</strong> Alpaquita:25: py3-lxml, Alpaquita:stream: py3-lxml</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-41066 https://cve.radiocsirt.org/vuln/brew-animdl-cve-2026-41066 <p><strong>Affected:</strong> Homebrew: animdl</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> <p><strong>Affected:</strong> Homebrew: animdl</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> https://cve.radiocsirt.org/vuln/brew-animdl-cve-2026-41066 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-292930 EUVD-2026-292930 https://cve.radiocsirt.org/vuln/euvd-2026-292930 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41066 <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41066 https://cve.radiocsirt.org/vuln/ghsa-vfmq-68hx-4jfw <p><strong>Affected:</strong> PyPI: lxml</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>### Impact Using either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.</p> <p>### Patches lxml 6.1.0 changes the default to `resolve_entities=&#39;internal&#39;`, thus disallowing local file access by default.</p> <p>### Workarounds Setting the `resolve_entities` option explicitly to `resolve_entities=&#39;internal&#39;` or `resolve_entities=False` disables the local file access.</p> <p>### Resources Original report: https://bugs.launchpad.net/lxml/+bug/2146291</p> <p>The default option was changed to `resolve_entities=&#39;internal&#39;` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.</p> https://cve.radiocsirt.org/vuln/ghsa-vfmq-68hx-4jfw https://cve.radiocsirt.org/vuln/msrc_cve-2026-41066 msrc_CVE-2026-41066 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41066 https://cve.radiocsirt.org/vuln/oesa-2026-2008 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-lxml</p> <p>\ Security Fix(es):</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&amp;apos;internal&amp;apos; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.(CVE-2026-41066)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-lxml</p> <p>\ Security Fix(es):</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&amp;apos;internal&amp;apos; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.(CVE-2026-41066)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2008 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10596-1 <p>python-lxml-doc-6.1.0-1.1 on GA media</p> <p>python-lxml-doc-6.1.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10596-1 https://cve.radiocsirt.org/vuln/pysec-2026-87 <p><strong>Affected:</strong> PyPI: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> <p><strong>Affected:</strong> PyPI: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-87 https://cve.radiocsirt.org/vuln/suse-su-2026:21587-1 <p>Security update for python-lxml</p> <p>Security update for python-lxml</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21587-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41066 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:Pro:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml, Ubuntu:22.04:LTS: lxml, Ubuntu:24.04:LTS: lxml, Ubuntu:25.10: lxml, Ubuntu:26.04:LTS: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:Pro:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml, Ubuntu:22.04:LTS: lxml, Ubuntu:24.04:LTS: lxml, Ubuntu:25.10: lxml, Ubuntu:26.04:LTS: lxml</p> <p>lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities=&#39;internal&#39; or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41066 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1219 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in lxml ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in lxml ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1219