Hi Alexandre,

The following vulnerability was published for xmlrpc-c.

Unfortunately there is not much detail and the third-party advisory at
time of writing this bugreport gives a 404. Can you please contact
upstream to see if that is known, if there is a public reference on
upstream on it?

CVE-2026-15928[0]:
| XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a
| reflected cross-site scripting (XSS) vulnerability in the error page
| component.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15928
https://www.cve.org/CVERecord?id=CVE-2026-15928

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore