https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-66294.htmlhttps://patchthecve.com/cve/CVE-2026-66294.htmlFri, 06 Nov 2026 10:16:49 +0000LOW 2.1: XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters <, >, &https://patchthecve.com/cve/CVE-2026-66295.htmlhttps://patchthecve.com/cve/CVE-2026-66295.htmlFri, 06 Nov 2026 10:16:45 +0000LOW 2.1: Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked against the constraints the XML specificatihttps://patchthecve.com/cve/CVE-2026-66293.htmlhttps://patchthecve.com/cve/CVE-2026-66293.htmlFri, 06 Nov 2026 10:16:42 +0000LOW 2.1: XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or re