An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
CVE-2026-105923 is a medium severity vulnerability in Qt where a malicious SVG can cause an integer overflow leading to a null-pointer dereference in the VectorImage QML Type. This can result in application crashes or denial of service. The affected versions are Qt 6.8.0 through 6.8.8 and 6.9.0 through 6.11.2. No official patch information is provided, and no known exploits are reported in the wild.
.
Security Fix(es):
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.(CVE-2026-101201)
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
CVE-2026-94370 is a medium severity vulnerability in Qt for MCUs versions 2.12.1 and 2.12.2. It involves a double free condition caused by improper handling of string memory ownership when converting std::string text passed into Qt Quick Ultralite. This can lead to heap memory corruption including double free, invalid free, or use-after-free errors.
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.
Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.
CVE-2026-78253 is a medium severity vulnerability in Qt's QXmlStreamReader::readElementText() function that allows denial of service via uncontrolled recursion. An attacker can cause an application crash by supplying a crafted XML document that triggers stack exhaustion.
CVE-2026-79616 is a medium severity vulnerability in Qt affecting versions from 5.10.0 through 6.8.8 and 6.9.0 through 6.11.1. It involves an out-of-bounds read when parsing untrusted SVG path strings in Qt Quick's Context2D.path and PathSvg.path components. The vulnerability has a CVSS 4.0 base score of 0.6, indicating low impact with partial exploitability requiring local privileges and user interaction. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-76151 is an out-of-bounds read vulnerability in the HTTP Cache-Control response header parsing within the QtNetwork module of Qt versions 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1. This flaw allows remote attackers to cause a denial of service (application crash) by sending an excessively large Cache-Control header value from an untrusted or compromised HTTP server to a client application using QNetworkAccessManager. The issue affects only the client side, does not impact 32-bit builds, and involves read-only out-of-bounds access without information disclosure or code execution.
CVE-2026-19248 is a high-severity vulnerability in the Qt framework's QDomDocument XML parsing component. It involves uncontrolled recursion that can be triggered remotely by processing crafted untrusted XML input, leading to a denial-of-service (DoS) crash. The affected versions range from 2.2.0 through 6.8.8 and 6.9.0 through 6.11.1. There is no explicit patch or remediation information provided in the source data. No known exploits in the wild have been reported.
CVE-2026-13326 is an out-of-bounds read vulnerability in Qt NFC's language code length parsing. This flaw allows a physically proximate attacker to cause a denial of service or limited memory disclosure by using a specially crafted NFC tag. The vulnerability affects Qt versions from 5.2.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.2. It has a CVSS 4.0 score of 6.9, indicating a critical severity level. No explicit patch links are provided in the data, and no known exploits are reported in the wild.
Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NUL-terminated (for example, one created with QByteArray::fromRawData()), the codec-name matching routine reads past the end of the supplied buffer. In most cases this results in an incorrect text codec being selected; in the worst case, if the over-read reaches unmapped memory, the process crashes (denial of service). The over-read is bounded by the length of the longest codec-name candidate, and the out-of-bounds bytes are only compared internally against Qt's fixed list of codec names, so no data is disclosed to an attacker. Applications that do not pass non-NUL-terminated QByteArrays to QTextCodec::codecForName() are not exposed. The affected code resides in the Qt5Compat module from Qt 6.0.0 onward, and in Qt Core (qtbase) in Qt 4.x and Qt 5.x.
An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow.
The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so.
Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.