{"schemaVersion":3,"id":"CVE-2026-41066","aliases":["ALPINE-CVE-2026-41066","SUSE-SU-2026:2488-1","SUSE-SU-2026:2728-1","SUSE-SU-2026:2729-1","SUSE-SU-2026:2752-1","SUSE-SU-2026:2754-1","GHSA-vfmq-68hx-4jfw","PYSEC-2026-87","UBUNTU-CVE-2026-41066","DEBIAN-CVE-2026-41066","CGA-25m7-89cv-36hq","CGA-3rr6-rc55-p7fr","CGA-3rvf-7gc4-j52j","CGA-6pwp-cjv4-f889","CGA-7ch9-55mg-5hj5","CGA-96j2-877j-5f8p","CGA-9q38-r8c2-28mw","CGA-cwc2-rg5w-m54h","CGA-ff7h-j55x-g2mp","CGA-hf3r-9f33-q8x5","CGA-hfq9-5jc7-64qv","CGA-m26f-w5p3-m773","CGA-mrw4-3wq5-jc3x","CGA-p45g-7867-374r","CGA-p9gv-46w5-76rf","CGA-qhgx-hq7g-5v3w","CGA-r5xx-4rp4-25wx","openSUSE-SU-2026:10596-1","CGA-3wj4-3m6r-6v9c","CGA-3x89-qpm2-qxp9","CGA-4866-449p-qx32","CGA-53pj-m59h-f6q3","CGA-5gpj-7qcp-g52g","CGA-5vg5-fjcf-8wph","CGA-6xfv-3wfw-9gj4","CGA-79cm-m784-m63p","CGA-7hfh-43wr-63hc","CGA-7w9v-4662-mqhp","CGA-854v-wfmf-pm3q","CGA-87m7-329x-9f79","CGA-8cv8-63gv-fp89","CGA-95g9-vgqw-6595","CGA-c2v6-ccmr-vr22","CGA-fm6p-q3c7-wqwp","CGA-g979-m4cx-g5x5","CGA-gcjw-x6gw-6vq6","CGA-hq69-whgj-fc7r","CGA-mcj3-8r9g-72cw","CGA-mv8q-fhjc-fmmx","CGA-pg9h-frr9-f8w9","CGA-ppjv-c3rh-g447","CGA-q986-849c-j899","CGA-qmp2-55wv-q4h2","CGA-rrhj-j6fw-h4r5","CGA-vh9x-6543-7c3x","CGA-wc22-7mfm-vrg7","CGA-wqq2-46w8-g825","CGA-ww83-vwv3-v87c","CGA-xg9v-w856-69xc","CGA-xrxr-p3gm-9fg7"],"status":"published","duplicateOf":null,"title":null,"description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.","dates":{"published":"2026-04-24T16:45:19.617Z","modified":"2026-04-24T18:04:04.548Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00324,"percentile":0.24031,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00324},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00324,"percentile":0.24031}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00409,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00324,"percentile":0.24031}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_AD34DAEF69D33F67","name":"Exploit Reference (bugs.launchpad.net)","source":"reference","url":"https://bugs.launchpad.net/lxml/+bug/2146291","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"alpine","product":"py3-lxml","name":"py3-lxml","label":"py3-lxml","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/py3-lxml","purlType":"apk","versions":[{"text":"< 6.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-2","name":"airflow-2","label":"airflow-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-3","name":"airflow-3","label":"airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-3","purlType":"apk","versions":[{"text":"< 3.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2025.12","name":"authentik-2025.12","label":"authentik-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2025.12","purlType":"apk","versions":[{"text":"< 2025.12.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.12.4-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2025.12","name":"authentik-fips-2025.12","label":"authentik-fips-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2025.12","purlType":"apk","versions":[{"text":"< 2025.12.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2025.12.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"awx","name":"awx","label":"awx","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/awx","purlType":"apk","versions":[{"text":"< 24.6.1-r49","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.6.1-r49","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.71-core-integrations","name":"datadog-agent-7.71-core-integrations","label":"datadog-agent-7.71-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.71-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.72-core-integrations","name":"datadog-agent-7.72-core-integrations","label":"datadog-agent-7.72-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.72-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.73-core-integrations","name":"datadog-agent-7.73-core-integrations","label":"datadog-agent-7.73-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.73-core-integrations","purlType":"apk","versions":[{"text":"< 7.73.3-r23","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.73.3-r23","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.74-core-integrations","name":"datadog-agent-7.74-core-integrations","label":"datadog-agent-7.74-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.74-core-integrations","purlType":"apk","versions":[{"text":"< 7.74.1-r24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.74.1-r24","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.75-core-integrations","name":"datadog-agent-7.75-core-integrations","label":"datadog-agent-7.75-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.75-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.76","name":"datadog-agent-7.76","label":"datadog-agent-7.76","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.76","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.76-core-integrations","name":"datadog-agent-7.76-core-integrations","label":"datadog-agent-7.76-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.76-core-integrations","purlType":"apk","versions":[{"text":"< 7.76.3-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.3-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.77-core-integrations","name":"datadog-agent-7.77-core-integrations","label":"datadog-agent-7.77-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations","purlType":"apk","versions":[{"text":"< 7.77.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.77.3-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.71-core-integrations","name":"datadog-agent-fips-7.71-core-integrations","label":"datadog-agent-fips-7.71-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.71-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.72-core-integrations","name":"datadog-agent-fips-7.72-core-integrations","label":"datadog-agent-fips-7.72-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.72-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.73-core-integrations","name":"datadog-agent-fips-7.73-core-integrations","label":"datadog-agent-fips-7.73-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.73-core-integrations","purlType":"apk","versions":[{"text":"< 7.73.3-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.73.3-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.74-core-integrations","name":"datadog-agent-fips-7.74-core-integrations","label":"datadog-agent-fips-7.74-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.74-core-integrations","purlType":"apk","versions":[{"text":"< 7.74.1-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.74.1-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.75-core-integrations","name":"datadog-agent-fips-7.75-core-integrations","label":"datadog-agent-fips-7.75-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.75-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.76-core-integrations","name":"datadog-agent-fips-7.76-core-integrations","label":"datadog-agent-fips-7.76-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.76-core-integrations","purlType":"apk","versions":[{"text":"< 7.76.3-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.3-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-fips-7.77-core-integrations","name":"datadog-agent-fips-7.77-core-integrations","label":"datadog-agent-fips-7.77-core-integrations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-fips-7.77-core-integrations","purlType":"apk","versions":[{"text":"< 7.77.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.77.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datahub-ingestion","name":"datahub-ingestion","label":"datahub-ingestion","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datahub-ingestion","purlType":"apk","versions":[{"text":"< 1.5.0.4-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.0.4-r1 | < 1.5.0.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datahub-ingestion-fips","name":"datahub-ingestion-fips","label":"datahub-ingestion-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datahub-ingestion-fips","purlType":"apk","versions":[{"text":"< 1.5.0.4-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.0.4-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-visualization-server","name":"kubeflow-pipelines-visualization-server","label":"kubeflow-pipelines-visualization-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-visualization-server","purlType":"apk","versions":[{"text":"< 2.16.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.16.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"label-studio","name":"label-studio","label":"label-studio","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/label-studio","purlType":"apk","versions":[{"text":"< 1.23.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.23.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/open-webui","purlType":"apk","versions":[{"text":"< 0.8.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.12-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-duplicity","name":"py3.13-duplicity","label":"py3.13-duplicity","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-duplicity","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"synapse","name":"synapse","label":"synapse","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/synapse","purlType":"apk","versions":[{"text":"< 1.151.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.151.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"airflow-3","name":"airflow-3","label":"airflow-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/airflow-3","purlType":"apk","versions":[{"text":"< 3.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.72-core-integrations","name":"datadog-agent-7.72-core-integrations","label":"datadog-agent-7.72-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.72-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.73-core-integrations","name":"datadog-agent-7.73-core-integrations","label":"datadog-agent-7.73-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.73-core-integrations","purlType":"apk","versions":[{"text":"< 7.73.3-r23","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.73.3-r23","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.74-core-integrations","name":"datadog-agent-7.74-core-integrations","label":"datadog-agent-7.74-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.74-core-integrations","purlType":"apk","versions":[{"text":"< 7.74.1-r24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.74.1-r24","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.75-core-integrations","name":"datadog-agent-7.75-core-integrations","label":"datadog-agent-7.75-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.75-core-integrations","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.76","name":"datadog-agent-7.76","label":"datadog-agent-7.76","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.76","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.76-core-integrations","name":"datadog-agent-7.76-core-integrations","label":"datadog-agent-7.76-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.76-core-integrations","purlType":"apk","versions":[{"text":"< 7.76.3-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.3-r15","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-agent-7.77-core-integrations","name":"datadog-agent-7.77-core-integrations","label":"datadog-agent-7.77-core-integrations","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations","purlType":"apk","versions":[{"text":"< 7.77.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.77.3-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-visualization-server","name":"kubeflow-pipelines-visualization-server","label":"kubeflow-pipelines-visualization-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-visualization-server","purlType":"apk","versions":[{"text":"< 2.16.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.16.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/open-webui","purlType":"apk","versions":[{"text":"< 0.8.12-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.12-r3","eol":null,"hubHref":null},{"vendor":"debian","product":"lxml","name":"lxml","label":"lxml","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/lxml","purlType":"deb","versions":[{"text":"< 4.9.2-1+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 6.1.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.2-1+deb12u1 | All versions (No fix recorded) | < 6.1.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"lxml","name":"lxml","label":"lxml","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/lxml","purlType":"deb","versions":[{"text":"< 3.3.3-1ubuntu0.2+esm6","noFixRecorded":false,"fixedIn":null},{"text":"< 3.5.0-1ubuntu0.4+esm3","noFixRecorded":false,"fixedIn":null},{"text":"< 4.2.1-1ubuntu0.6+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.5.0-1ubuntu0.5+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.8.0-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 5.2.1-1ubuntu0.2","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 6.0.2-1ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.3-1ubuntu0.2+esm6 | < 3.5.0-1ubuntu0.4+esm3 | < 4.2.1-1ubuntu0.6+esm1 | < 4.5.0-1ubuntu0.5+esm1 | < 4.8.0-1ubuntu0.1 | < 5.2.1-1ubuntu0.2 | All versions (No fix recorded) | < 6.0.2-1ubuntu0.1","eol":null,"hubHref":null},{"vendor":"lxml","product":"lxml","name":"lxml","label":"lxml","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0","eol":null,"hubHref":"/vendor/lxml/lxml"},{"vendor":"PyPI","product":"lxml","name":"lxml","label":"lxml","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/lxml","purlType":"pypi","versions":[{"text":"< 6.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0","eol":null,"hubHref":null},{"vendor":"opensuse","product":"python-lxml&distro=openSUSE Tumbleweed","name":"python-lxml","label":"python-lxml&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/python-lxml&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 6.1.0-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Micro 5.3","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Micro 5.3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Micro 5.3","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Micro 5.4","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Micro 5.4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Micro 5.4","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.15.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Module for Python 3 15 SP7","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Module for Python 3 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Module for Python 3 15 SP7","purlType":"rpm","versions":[{"text":"< 4.9.3-150400.8.11.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.3-150400.8.11.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 3.6.1-8.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-8.8.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python3-lxml&distro=SUSE Linux Enterprise Micro 5.5","name":"python3-lxml","label":"python3-lxml&distro=SUSE Linux Enterprise Micro 5.5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python3-lxml&distro=SUSE Linux Enterprise Micro 5.5","purlType":"rpm","versions":[{"text":"< 4.9.1-150500.3.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.1-150500.3.7.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python3-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","name":"python3-lxml","label":"python3-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python3-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","purlType":"rpm","versions":[{"text":"< 4.9.1-150500.3.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.1-150500.3.7.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python3-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"python3-lxml","label":"python3-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python3-lxml&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 3.6.1-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-3.9.1","eol":null,"hubHref":null}],"affectedCount":51,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw","label":"github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","REPORT","Mitigation","Vendor Advisory"]},{"url":"https://bugs.launchpad.net/lxml/+bug/2146291","label":"bugs.launchpad.net/lxml/+bug/2146291","hostname":"bugs.launchpad.net","tags":["X Refsource MISC","WEB","REPORT","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41066","label":"security.alpinelinux.org/vuln/CVE-2026-41066","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262488-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262488-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1263254","label":"bugzilla.suse.com/1263254","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","label":"www.suse.com/security/cve/CVE-2026-41066","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262728-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262728-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262729-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262729-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262752-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262752-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262754-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262754-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41066","label":"nvd.nist.gov/vuln/detail/CVE-2026-41066","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/lxml/lxml","label":"github.com/lxml/lxml","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.0","label":"github.com/lxml/lxml/releases/tag/lxml-6.1.0","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2026-87.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2026-87.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-41066","label":"ubuntu.com/security/CVE-2026-41066","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41066","label":"www.cve.org/CVERecord?id=CVE-2026-41066","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-8897-1","label":"ubuntu.com/security/notices/USN-8897-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41066","label":"security-tracker.debian.org/tracker/CVE-2026-41066","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41066.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41066.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["SUSE-SU-2026:4580-1","SUSE-SU-2026:4581-1","SUSE-SU-2026:4582-1","SUSE-SU-2026:4583-1","SUSE-SU-2026:4584-1","SUSE-SU-2026:4585-1","USN-8897-1"],"duplicates":[],"related":["CGA-48Q6-WGRM-M89M","SUSE-SU-2026:4580-1","SUSE-SU-2026:4581-1","SUSE-SU-2026:4582-1","SUSE-SU-2026:4583-1","SUSE-SU-2026:4584-1","SUSE-SU-2026:4585-1","USN-8897-1"]},"timeline":[{"kind":"published","date":"2026-04-24T16:45:19.617Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-24T18:04:04.548Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:26:54.184Z","stale":false,"partial":false}}