These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-40042 is a critical XML external entity injection vulnerability in Pachno 1.0.6, allowing unauthenticated attackers to read arbitrary files via unsafe XML parsing in the TextParser helper. The vulnerability is triggered by injecting malicious XML entities through wiki table syntax and inline tags in issue descriptions, comments, and wiki articles.
CVE-2026-40038 is a stored cross-site scripting vulnerability in Pachno 1.0.6 that allows attackers to inject malicious scripts through multiple parameters, which are stored in the database and executed in users' browser sessions due to improper sanitization. This vulnerability requires defenders to assess exposure and implement compensating controls to prevent exploitation. The vulnerability affects Pach [truncated]