Skip to main content
CVE-2024-8010 Apr 16, 09:39 LOW PATCH Monitor

The component accepts XML input through the publisher without disabling external entity resolution. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

XXE Wso2 Api Manager Wso2
NVD VulDB
CVSS 3.1
3.5
EPSS
0.0%
CVE-2026-3155 Apr 16, 11:21 LOW Monitor

Authorization bypass in the OneSignal - Web Push Notifications plugin for WordPress allows authenticated attackers with subscriber-level access to delete OneSignal metadata on arbitrary posts they do not own. Affected versions span all releases up to and including 3.8.0. No public exploit code exists and CISA has not listed this in KEV; with an EPSS of 0.03% and SSVC exploitation status of 'none', real-world risk is currently low despite being network-reachable.

WordPress Authentication Bypass Onesignal Web Push Notifications Wordpress Plugin Onesignal
NVD VulDB
CVSS 3.1
3.1
EPSS
0.0%
CVE-2026-41080 Apr 16, 16:52 LOW POC PATCH Monitor

Hash flooding denial-of-service in libexpat before 2.7.6 stems from the existing SipHash-based collision protection consuming only 4-8 bytes of salt entropy (constrained by the width of `unsigned long`) when the SipHash implementation supports a full 16-byte key - reducing the effective salt space and enabling a knowledgeable attacker to craft XML documents with deliberately colliding element or attribute names. All libexpat versions from 0 through 2.7.5 are affected per CPE cpe:2.3:a:libexpat_project:libexpat. No active exploitation has been confirmed (no CISA KEV listing), EPSS sits at 0.01% (2nd percentile), and SSVC designates exploitation as none and the flaw as non-automatable, placing real-world urgency firmly in the low tier.

Information Disclosure Libexpat Libexpat Project
NVD GitHub VulDB
CVSS 3.1
2.9
EPSS
0.0%
CVE-2026-27820 Apr 16, 17:27 LOW PATCH GHSA Monitor

Buffer overflow in the Ruby zlib gem's Zlib::GzipReader allows remote or local attackers supplying crafted gzip data to corrupt process memory via the zstream_buffer_ungets function. Affected versions span all 3.0.x releases through 3.0.0, the 3.1.0-3.1.1 range, and 3.2.0-3.2.1, collectively covering a wide install base across Ruby 3.2 and 3.3 runtime environments. The vulnerability carries an EPSS of 0.04% (13th percentile) and is not listed in CISA KEV, indicating low current exploitation probability despite the memory-corruption class of the flaw.

Buffer Overflow Ruby Zlib
NVD GitHub VulDB
CVSS 4.0
1.7
EPSS
0.0%

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy