{
  "cveId": "CVE-2026-15037",
  "url": "https://patchblox.com/security/cve/CVE-2026-15037",
  "summary": "CVE-2026-15037 is fixed in qt6-base on 1 platform by DEBIAN-CVE-2026-15037 (version 6.11.2\u002Bdfsg-6), released July 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "qt6-base: Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt...",
  "description": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.",
  "published": "2026-07-23T13:16:25Z",
  "severity": "",
  "epss": 0.00444,
  "epssPercentile": 0.38808,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "qt6-base",
      "release": "Debian 14",
      "fixedVersion": "6.11.2\u002Bdfsg-6",
      "fix": "DEBIAN-CVE-2026-15037",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-15037",
      "released": "2026-07-23T13:16:25Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}