CVE-2026-56412
Medium Severity Description libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
Vendor Advisories
CVE-2026-56410
Medium Severity Description xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. Read more at https://www.tenable.com/cve/CVE-2026-56410
DSA-6359-1 gst-plugins-good1.0 – security update
https://security-tracker.debian.org/tracker/DSA-6359-1
DSA-6360-1 squid – security update
https://security-tracker.debian.org/tracker/DSA-6360-1
DSA-6358-1 libhttp-daemon-perl – security update
https://security-tracker.debian.org/tracker/DSA-6358-1
DSA-6357-1 pillow – security update
https://security-tracker.debian.org/tracker/DSA-6357-1
DSA-6356-1 imagemagick – security update
https://security-tracker.debian.org/tracker/DSA-6356-1
DSA-6355-1 linux – security update
https://security-tracker.debian.org/tracker/DSA-6355-1
CVE-2026-5366
Critical Severity Description Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled
CVE-2026-56332
Medium Severity Description Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers
CVE-2026-56330
Medium Severity Description Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept
Threat Brief: Mitigating Large-Scale Credential Attacks
We provide guidance for preparing for mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors’ devices.