https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T23:49:33.586769+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cleanstart-2026-ce10526 Withdrawn: CLEANSTART-2026-CE10526 — Security fixes for CVE-2025-64756, CVE-2025-69873, CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026… 2026-09-29T23:49:34.032396+00:00

Withdrawn by the publisher.

Affected: CleanStart: renovate

Multiple security vulnerabilities affect the renovate package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://vulnerability.circl.lu/vuln/cve-2026-25896 CVE-2026-25896 — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 2026-09-29T23:49:34.032497+00:00

Affected: NaturalIntelligence fast-xml-parser, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat Satellite 6.18, Red Hat Migration Toolkit for Applications 8 and 4 more

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.