XML

A discussion is revisiting why Microsoft's OOXML document specification spans 6,546 pages while the open ODF standard needs only 867. The explanation given: OOXML hard-codes the behaviour of discontinued software through compatibility switches like lineWrapLikeWord6, whereas ODF relies on open standards such as SVG and MathML. Commenters note the debate over document formats is set to return in 2026.

A newly published vulnerability, CVE-2026-93891, affects IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8. The flaw carries a CVSS score of 7.6 and stems from XML external entity injection. A remote authenticated attacker could exploit it to obtain sensitive information. Security teams managing IBM TRIRIGA deployments are being urged to review the advisory and check whether patched releases are available.

A newly disclosed vulnerability, CVE-2026-94401, affects MISP, the open-source threat intelligence sharing platform. Authenticated users can exploit the file-handling flaw through XML import to read files on the server or reach internal services. The issue carries a CVSS score of 7.7, and a patch is reportedly still under review, prompting security teams to monitor for the fix.

A decade-old security flaw in the Expat XML parsing library is listed as EUVD-2016-0749, published in May 2016 and recently updated in the EU vulnerability database. The bug lets context-dependent attackers trigger a buffer overflow via a malformed input document, potentially crashing systems or executing arbitrary code. Applications relying on outdated Expat versions remain exposed, and administrators are advised to patch.

A vulnerability catalogue entry, EUVD-2016-5459, describes a flaw in the Expat XML parsing library: compilers using certain optimization settings remove the library's overflow protection, which could let remote attackers crash applications or potentially execute arbitrary code through crafted input. The advisory was first published in June 2016 and recently updated. Security teams tracking Expat dependencies are being urged to review their build configurations and patch levels.

A security advisory, EUVD-2017-18171, describes an XML external entity vulnerability in the Expat XML parser library, affecting libexpat version 2.2.0 and earlier. Attackers can supply a malformed external entity definition that forces the parser into an infinite loop, causing denial of service. The advisory was originally published in July 2017 and was recently updated, renewing attention on systems still running unpatched versions of the widely used library.

A security advisory, EUVD-2019-0173, warns that FasterXML jackson-databind 2.x before 2.9.7 may allow remote attackers to execute arbitrary code. The flaw stems from a failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. Administrators running affected versions are advised to upgrade to 2.9.7 or later. The advisory, originally published in January 2019, has recently been updated, drawing renewed attention to the widely used Java library.

A vulnerability tracked as EUVD-2021-1791, scored 7.5 out of 10 under CVSS v3.1, affects jsoup, a widely used Java library for parsing HTML. Applications using jsoup versions prior to 1.14.2 to process untrusted HTML or XML can be knocked offline by denial-of-service attacks. The advisory, first published in August 2021 and updated in October 2026, recommends updating to a patched release. Security teams are being urged to check whether their Java dependencies include an affected version.