CVE-2026-88789 | High | 8.6 | 2026-10-01 | Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.3… |
CVE-2026-102127 | High | 7.0 | 2026-09-30 | An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature… |
CVE-2026-82386 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and rea… |
CVE-2026-82376 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse a… |
CVE-2026-93030 | Medium | 6.5 | 2026-09-25 | FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw. |
CVE-2026-61741 | Critical | 9.3 | 2026-09-24 | http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders us… |
CVE-2026-81536 | High | 7.7 | 2026-09-23 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) inj… |
CVE-2026-18184 | High | 7.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE)… |
CVE-2026-18172 | High | 7.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML e… |
CVE-2026-17646 | High | 8.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restri… |
CVE-2026-61570 | High | 7.5 | 2026-09-22 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a Do… |
CVE-2026-94108 | Medium | 6.5 | 2026-09-20 | getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on… |
CVE-2026-76446 | Medium | 4.9 | 2026-09-16 | A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating… |
CVE-2026-76427 | Medium | 4.9 | 2026-09-16 | A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an a… |
CVE-2026-12752 | High | 7.1 | 2026-09-15 | IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2026-12667 | High | 7.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12666 | High | 8.1 | 2026-09-15 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-91197 | Medium | 6.5 | 2026-09-14 | Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable… |
CVE-2026-13265 | Medium | 6.8 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-12756 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2026-13287 | High | 7.1 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-13285 | High | 7.1 | 2026-09-14 | IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose se… |
CVE-2026-13275 | High | 7.1 | 2026-09-14 | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4… |
CVE-2026-13107 | High | 7.1 | 2026-09-14 | IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default. |
CVE-2026-16432 | High | 7.7 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due t… |
CVE-2026-18061 | Medium | 5.9 | 2026-09-11 | Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with… |
CVE-2026-89260 | High | 7.5 | 2026-09-11 | MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.inde… |
CVE-2026-82578 | High | 7.5 | 2026-09-11 | When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restriction… |
CVE-2026-78224 | High | 8.2 | 2026-09-11 | The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-… |
CVE-2026-89212 | High | 8.6 | 2026-09-11 | A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The… |
CVE-2026-84941 | | | 2026-09-11 | An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration… |
CVE-2026-19596 | Medium | 5.9 | 2026-09-10 | An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a s… |
CVE-2026-79572 | High | 7.5 | 2026-09-08 | An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal n… |
CVE-2026-19614 | | | 2026-09-08 | The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled.
This issue affects NanoXML: 2.2.3. |
CVE-2026-71375 | High | 7.4 | 2026-09-08 | Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from… |
CVE-2026-76958 | High | 8.5 | 2026-09-08 | SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privile… |
CVE-2026-17444 | Medium | 5.3 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-17443 | Medium | 5.3 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-81832 | High | 7.7 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is… |
CVE-2026-82525 | Medium | 5.5 | 2026-09-03 | Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesys… |
CVE-2026-82918 | Medium | 5.5 | 2026-09-03 | XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially craft… |
CVE-2026-17615 | High | 7.5 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending… |
CVE-2026-82880 | High | 7.5 | 2026-08-31 | YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external… |
CVE-2026-55848 | High | 8.6 | 2026-08-28 | mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts… |
CVE-2026-76572 | Medium | 4.7 | 2026-08-19 | A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTra… |
CVE-2026-20320 | High | 7.5 | 2026-08-19 | A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configurati… |
CVE-2026-67268 | Medium | 6.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker w… |
CVE-2026-70423 | Medium | 6.5 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker… |
CVE-2026-75058 | Medium | 5.5 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers |
CVE-2026-75055 | Medium | 5.5 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE |
CVE-2026-69101 | High | 7.7 | 2026-08-14 | Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery an… |
CVE-2026-18715 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities. |
CVE-2026-15803 | | | 2026-08-12 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query… |
CVE-2026-16999 | Medium | 6.3 | 2026-08-12 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This… |
CVE-2026-73235 | Medium | 6.1 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XM… |
CVE-2026-58248 | Medium | 6.5 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containin… |
CVE-2026-16626 | | | 2026-08-10 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.
This issue affects JasperReports Ser… |
CVE-2026-65432 | High | 7.5 | 2026-08-06 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import… |
CVE-2026-70448 | High | 7.1 | 2026-08-05 | Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files. |
CVE-2026-10025 | High | 8.2 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability r… |
CVE-2026-14304 | Medium | 5.5 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versi… |
CVE-2025-36374 | Medium | 5.5 | 2026-07-30 | IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerabili… |
CVE-2026-54366 | High | 7.5 | 2026-07-30 | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by su… |
CVE-2026-50782 | High | 7.5 | 2026-07-29 | Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint… |
CVE-2026-54082 | Medium | 6.5 | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML Extern… |
CVE-2026-54079 | | | 2026-07-29 | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation cont… |
CVE-2026-54078 | | | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML Extern… |
CVE-2026-57917 | | | 2026-07-27 | proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, dep… |
CVE-2026-56817 | Critical | 9.8 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through… |
CVE-2026-51080 | Critical | 9.8 | 2026-07-17 | libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2026-8396 | High | 7.5 | 2026-07-17 | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking.
This issue affects… |
CVE-2026-48359 | Critical | 9.6 | 2026-07-14 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code exec… |
CVE-2026-45071 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlC… |
CVE-2026-54470 | Medium | 5.3 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged… |
CVE-2026-55471 | Critical | 9.1 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities… |
CVE-2026-57259 | Medium | 6.5 | 2026-07-08 | The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF… |
CVE-2026-47898 | Critical | 9.8 | 2026-07-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).
This issue affects Apache Lucen… |
CVE-2026-13449 | High | 7.6 | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A re… |
CVE-2026-44018 | Medium | 5.5 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the ME… |
CVE-2026-12975 | High | 8.5 | 2026-06-25 | A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or dis… |
CVE-2026-57234 | Low | 2.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default… |
CVE-2026-44020 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the US… |
CVE-2026-56701 | Medium | 6.5 | 2026-06-23 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbi… |
CVE-2026-6653 | Critical | 9.8 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via malici… |
CVE-2026-12788 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /… |
CVE-2026-48981 | Medium | 6.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when lo… |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2026-49875 | Critical | 9.8 | 2026-06-12 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enablin… |
CVE-2026-40998 | High | 8.2 | 2026-06-11 | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's defa… |
CVE-2026-40991 | Medium | 5.9 | 2026-06-10 | When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tri… |
CVE-2026-47960 | High | 7.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2026-8045 | Medium | 6.5 | 2026-06-09 | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
CVE-2026-49383 | Low | 3.3 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible |
CVE-2026-2253 | High | 7.7 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fro… |
CVE-2026-3603 | High | 7.1 | 2026-05-26 | IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Inter… |
CVE-2026-44618 | Medium | 5.3 | 2026-05-22 | Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.
Users are recommended to upgrade to versions 4… |
CVE-2026-46722 | | | 2026-05-19 | The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause loc… |
CVE-2026-39053 | Medium | 6.5 | 2026-05-15 | Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework par… |
CVE-2026-44445 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) refere… |
CVE-2026-41895 | High | 7.5 | 2026-05-12 | changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and cre… |