https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T19:37:55.580005+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-117610 fkie_cve-2026-117610 2026-11-07T19:37:55.647703+00:00

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

 https://db.gcve.eu/vuln/ghsa-v4h5-6r69-76p3 GHSA-v4h5-6r69-76p3 2026-11-07T19:37:55.647884+00:00

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

 https://db.gcve.eu/vuln/msrc_cve-2026-117610 msrc_CVE-2026-117610 — libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser 2026-11-07T19:37:55.647907+00:00 msrc_CVE-2026-117610 https://db.gcve.eu/vuln/opensuse-su-2026:12396-1 openSUSE-SU-2026:12396-1 — expat-2.10.0-1.1 on GA media 2026-11-07T19:37:55.647929+00:00

expat-2.10.0-1.1 on GA media

 https://db.gcve.eu/vuln/ubuntu-cve-2026-117610 UBUNTU-CVE-2026-117610 2026-11-07T19:37:55.647947+00:00

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 64 more

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.