https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T05:12:05.197424+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-2qp8-23fp-hmf7 GHSA-2qp8-23fp-hmf7 2026-11-15T05:12:05.202402+00:00

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

 https://db.gcve.eu/vuln/msrc_cve-2026-128241 msrc_CVE-2026-128241 — libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory 2026-11-15T05:12:05.202478+00:00 msrc_CVE-2026-128241 https://db.gcve.eu/vuln/ubuntu-cve-2026-128241 UBUNTU-CVE-2026-128241 2026-11-15T05:12:05.202519+00:00

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 64 more

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.