https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-18T00:05:17.131502+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-41066 CVE-2026-41066 — lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files 2026-10-18T00:05:17.143135+00:00

Affected: lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

 https://db.gcve.eu/vuln/usn-8897-1 USN-8897-1 — lxml vulnerabilities 2026-10-18T00:05:17.143207+00:00

Affected: Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:Pro:16.04:LTS: lxml, Ubuntu:Pro:18.04:LTS: lxml, Ubuntu:Pro:20.04:LTS: lxml, Ubuntu:22.04:LTS: lxml, Ubuntu:24.04:LTS: lxml, Ubuntu:26.04:LTS: lxml

Guillem Lefait discovered that lxml incorrectly handled certain URL attributes. A remote attacker could possibly use this issue to bypass URL sanitization, leading to a cross-site scripting attack. (CVE-2026-49825)

Qiu Sihao discovered that lxml incorrectly handled untrusted XML input. A remote attacker could possibly use this issue to read local files and expose sensitive information. This issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-41066)