Posted by Robert Lazarski on Nov 11 Severity: low Affected versions: - Apache Axis2/C f2b30c159720cf63ada72f19183828533154c749 before 23110287924e79d05a5b4712298c355d1f05c606 - Apache Axis2/C through 2.0.0 Description: Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a...
CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/679
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities
Posted by Alan Coopersmith on Nov 12 https://www.postgresql.org/about/news/postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442/ announces:
Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined announcement)
Posted by Markus Jung on Nov 12 On 10 November 2026, the Apache TomEE project published 38 security advisories on users () tomee apache org. This message consolidates…
Re: Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 11 Releases are out, more info at https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
CVE-2026-123765: Apache Sling XSS: SLING-13406
Posted by Joerg Hoh on Nov 11 Severity: low Affected versions: - Apache Sling XSS before 2.4.14 Description: Improper neutralization of input during web page generation…
CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks
Posted by Simon Steiner on Nov 11 Severity: moderate Affected versions: - Apache XML Graphics Batik 1.19 Description: Server-Side Request Forgery (SSRF) vulnerability in…
CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont
Posted by Simon Steiner on Nov 11 Severity: moderate Affected versions: - Apache XML Graphics Batik 1.19 Description: Cross-Site Scripting via Unencoded Font Metadata in…