CVE-2026-69101 | High | 7.7 | 2026-08-14 | Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery an… |
CVE-2026-18715 | Medium | 6.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities. |
CVE-2026-15803 | | | 2026-08-12 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query… |
CVE-2026-16999 | Medium | 6.3 | 2026-08-12 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This… |
CVE-2026-73235 | Medium | 6.1 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XM… |
CVE-2026-58248 | Medium | 6.5 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containin… |
CVE-2026-16626 | | | 2026-08-10 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.
This issue affects JasperReports Ser… |
CVE-2026-65432 | High | 7.5 | 2026-08-06 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import… |
CVE-2026-70448 | High | 7.1 | 2026-08-05 | Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files. |
CVE-2026-10025 | High | 8.2 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability r… |
CVE-2026-14304 | Medium | 5.5 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versi… |
CVE-2025-36374 | Medium | 5.5 | 2026-07-30 | IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerabili… |
CVE-2026-54366 | High | 7.5 | 2026-07-30 | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by su… |
CVE-2026-50782 | High | 7.5 | 2026-07-29 | Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint… |
CVE-2026-54082 | Medium | 6.5 | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML Extern… |
CVE-2026-54079 | | | 2026-07-29 | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation cont… |
CVE-2026-54078 | | | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML Extern… |
CVE-2026-57917 | | | 2026-07-27 | proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, dep… |
CVE-2026-56817 | Critical | 9.8 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through… |
CVE-2026-51080 | Critical | 9.8 | 2026-07-17 | libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2026-8396 | High | 7.5 | 2026-07-17 | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking.
This issue affects… |
CVE-2026-48359 | Critical | 9.6 | 2026-07-14 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code exec… |
CVE-2026-45071 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlC… |
CVE-2026-54470 | Medium | 5.3 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged… |
CVE-2026-55471 | Critical | 9.1 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities… |
CVE-2026-57259 | Medium | 6.5 | 2026-07-08 | The input file does not need to be strictly in a structurally valid PDF format. Instead, after reviewing the content, the original document disguised as a PDF… |
CVE-2026-47898 | Critical | 9.8 | 2026-07-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).
This issue affects Apache Lucen… |
CVE-2026-13449 | High | 7.6 | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A re… |
CVE-2026-44018 | Medium | 5.5 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the ME… |
CVE-2026-12975 | High | 8.5 | 2026-06-25 | A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or dis… |
CVE-2026-57234 | Low | 2.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default… |
CVE-2026-44020 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the US… |
CVE-2026-56701 | Medium | 6.5 | 2026-06-23 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbi… |
CVE-2026-6653 | Critical | 9.8 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via malici… |
CVE-2026-12788 | Medium | 6.3 | 2026-06-21 | A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /… |
CVE-2026-48981 | Medium | 6.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb calls xmlReadFile() with flags=0 when lo… |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2026-49875 | Critical | 9.8 | 2026-06-12 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enablin… |
CVE-2026-40998 | High | 8.2 | 2026-06-11 | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's defa… |
CVE-2026-40991 | Medium | 5.9 | 2026-06-10 | When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tri… |
CVE-2026-47960 | High | 7.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2026-8045 | Medium | 6.5 | 2026-06-09 | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
CVE-2026-49383 | Low | 3.3 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible |
CVE-2026-2253 | High | 7.7 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fro… |
CVE-2026-3603 | High | 7.1 | 2026-05-26 | IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Inter… |
CVE-2026-44618 | Medium | 5.3 | 2026-05-22 | Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.
Users are recommended to upgrade to versions 4… |
CVE-2026-46722 | | | 2026-05-19 | The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause loc… |
CVE-2026-39053 | Medium | 6.5 | 2026-05-15 | Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework par… |
CVE-2026-44445 | Medium | 6.5 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) refere… |
CVE-2026-41895 | High | 7.5 | 2026-05-12 | changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and cre… |
CVE-2026-42212 | | | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .g… |
CVE-2023-42346 | High | 7.5 | 2026-05-08 | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. |
CVE-2023-42344 | High | 7.3 | 2026-05-08 | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet. |
CVE-2026-41936 | High | 8.1 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_adm… |
CVE-2026-38429 | Critical | 9.8 | 2026-05-05 | OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files contai… |
CVE-2026-40682 | Critical | 9.1 | 2026-05-04 | XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor
Versions Affected: before 2.5.9, before 3.0.0-M3
De… |
CVE-2026-6501 | | | 2026-05-04 | Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup.
This… |
CVE-2026-36765 | High | 8.8 | 2026-04-30 | An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code… |
CVE-2025-14543 | Critical | 9.1 | 2026-04-30 | Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.This i… |
CVE-2024-13971 | High | 7.5 | 2026-04-30 | Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read acc… |
CVE-2024-39847 | High | 7.5 | 2026-04-30 | Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to… |
CVE-2026-6807 | Medium | 5.5 | 2026-04-28 | A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to
trigger improper handling of XML input, which may result in unintended
exposure of sensi… |
CVE-2026-41066 | High | 7.5 | 2026-04-24 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolv… |
CVE-2026-40882 | High | 7.6 | 2026-04-22 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit… |
CVE-2026-22016 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2024-8010 | Low | 3.5 | 2026-04-16 | The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payloa… |
CVE-2024-2374 | High | 7.5 | 2026-04-16 | The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This o… |
CVE-2026-26171 | High | 7.5 | 2026-04-14 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-33737 | Medium | 5.3 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NO… |
CVE-2026-4374 | Critical | 9.1 | 2026-04-01 | Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Cloud Discovery Service, Recording Service, Routing Service, Q… |
CVE-2026-34401 | Medium | 6.5 | 2026-03-31 | XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad… |
CVE-2026-29924 | High | 7.6 | 2026-03-30 | Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin. |
CVE-2026-4980 | Medium | 6.3 | 2026-03-27 | A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafte… |
CVE-2026-33913 | High | 7.7 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with a… |
CVE-2026-28809 | Medium | 5.3 | 2026-03-23 | XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into… |
CVE-2026-33371 | Medium | 4.3 | 2026-03-20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS… |
CVE-2026-3511 | High | 8.6 | 2026-03-19 | Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to co… |
CVE-2026-32251 | Medium | 6.5 | 2026-03-12 | Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable… |
CVE-2026-1567 | High | 7.1 | 2026-03-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 An XML External Entity (XXE) vulnerability in IBM InfoSphere Information Server could allow attacke… |
CVE-2026-3404 | Medium | 5.0 | 2026-03-02 | A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the com… |
CVE-2026-2252 | High | 7.5 | 2026-02-27 | An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious exter… |
CVE-2025-36247 | High | 7.1 | 2026-02-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injec… |
CVE-2026-2536 | Medium | 6.3 | 2026-02-16 | A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow… |
CVE-2020-37192 | Medium | 6.2 | 2026-02-11 | MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input… |
CVE-2026-1227 | | | 2026-02-11 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within… |
CVE-2026-2074 | Medium | 6.3 | 2026-02-07 | A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP P… |
CVE-2026-23739 | Low | 2.0 | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open(… |
CVE-2026-23795 | Medium | 4.9 | 2026-02-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console.
An administrator with adequate entitlements to create or edit Ke… |
CVE-2026-21569 | High | 7.9 | 2026-01-28 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.
This XXE (XML Externa… |
CVE-2026-24400 | Critical | 9.1 | 2026-01-26 | AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External… |
CVE-2025-65482 | Critical | 9.8 | 2026-01-20 | An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx f… |
CVE-2026-1218 | Medium | 6.3 | 2026-01-20 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.arte… |
CVE-2025-14478 | High | 7.5 | 2026-01-17 | The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file u… |
CVE-2022-50899 | Medium | 6.5 | 2026-01-13 | Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server… |
CVE-2025-68493 | High | 8.1 | 2026-01-11 | Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 thr… |
CVE-2026-22186 | High | 7.1 | 2026-01-07 | Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., X… |
CVE-2026-20029 | Medium | 4.9 | 2026-01-07 | A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authen… |
CVE-2025-36589 | High | 7.6 | 2026-01-06 | Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker w… |
CVE-2025-68280 | Medium | 6.5 | 2026-01-05 | Improper Restriction of XML External Entity Reference vulnerability in Apache SIS.
It is possible to write XML files in such a way that, when parsed by Apac… |
CVE-2025-15251 | Medium | 5.6 | 2025-12-30 | A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/jav… |