CVE-2026-16180 | Medium | 5.7 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could… |
CVE-2026-78681 | High | 7.5 | 2026-08-25 | NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft… |
CVE-2026-73569 | | | 2026-08-13 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser… |
CVE-2026-3415 | High | 8.7 | 2026-08-06 | The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the… |
CVE-2026-14865 | Medium | 5.3 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowin… |
CVE-2026-14979 | Medium | 5.3 | 2026-07-17 | IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0… |
CVE-2026-45304 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Componen… |
CVE-2026-45133 | High | 7.5 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser… |
CVE-2026-44018 | Medium | 5.5 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the ME… |
CVE-2026-12993 | Medium | 6.5 | 2026-06-26 | A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or… |
CVE-2026-44020 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the US… |
CVE-2026-45771 | High | 7.5 | 2026-06-09 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2026-23822 | Medium | 5.3 | 2026-05-12 | A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. S… |
CVE-2026-31248 | High | 7.5 | 2026-05-11 | Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives… |
CVE-2026-42212 | | | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .g… |
CVE-2026-41673 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-40260 | Medium | 5.3 | 2026-04-17 | pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker… |
CVE-2026-33116 | High | 7.5 | 2026-04-14 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-26171 | High | 7.5 | 2026-04-14 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-33908 | High | 7.5 | 2026-04-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the… |
CVE-2026-33036 | High | 7.5 | 2026-03-20 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vul… |
CVE-2026-29074 | High | 7.5 | 2026-03-06 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from ver… |
CVE-2026-27807 | Medium | 4.9 | 2026-03-06 | MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML file… |
CVE-2026-26278 | High | 7.5 | 2026-02-19 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4… |
CVE-2025-20369 | Medium | 4.6 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-5466 | Medium | 4.9 | 2025-08-12 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2019-19144 | Critical | 9.8 | 2025-08-01 | XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate. |
CVE-2025-3225 | High | 7.5 | 2025-07-07 | An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifica… |
CVE-2025-0617 | Medium | 5.9 | 2025-01-29 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger… |
CVE-2024-43398 | Medium | 5.9 | 2024-08-22 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local nam… |
CVE-2024-28982 | High | 7.1 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of th… |
CVE-2024-27142 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2024-27141 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2024-1455 | Medium | 5.9 | 2024-03-26 | A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multi… |
CVE-2024-28757 | High | 7.5 | 2024-03-10 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). |
CVE-2023-52426 | Medium | 5.5 | 2024-02-04 | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. |
CVE-2023-49967 | High | 7.5 | 2023-12-07 | Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. |
CVE-2023-41635 | Medium | 6.5 | 2023-08-31 | A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the… |
CVE-2023-3569 | Medium | 4.9 | 2023-08-08 | In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote att… |
CVE-2023-38490 | Medium | 6.8 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the… |
CVE-2023-28118 | High | 7.5 | 2023-03-20 | kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and alias… |
CVE-2023-20052 | Medium | 5.3 | 2023-03-01 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the DMG file parser of ClamAV versions 1.0.0… |
CVE-2022-44641 | Medium | 6.5 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML e… |
CVE-2022-34430 | High | 7.1 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-25857 | High | 7.5 | 2022-08-30 | The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. |
CVE-2022-0217 | High | 7.5 | 2022-08-26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given… |
CVE-2022-33977 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTD… |
CVE-2022-34467 | Medium | 6.5 | 2022-07-12 | A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compa… |
CVE-2021-41559 | Medium | 6.5 | 2022-06-28 | Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document. |
CVE-2021-40511 | High | 7.5 | 2022-06-21 | OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service. |
CVE-2021-20464 | Medium | 6.5 | 2022-04-22 | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. I… |
CVE-2022-26662 | High | 7.5 | 2022-03-10 | An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… |
CVE-2022-23640 | Critical | 9.8 | 2022-03-02 | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was use… |
CVE-2021-31842 | Medium | 5.0 | 2021-09-17 | XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiat… |
CVE-2021-38490 | High | 7.5 | 2021-08-10 | Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425. |
CVE-2021-3541 | Medium | 6.5 | 2021-07-09 | A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. |
CVE-2020-15303 | Medium | 6.5 | 2021-06-28 | Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. |
CVE-2021-32623 | High | 8.1 | 2021-06-16 | Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laugh… |
CVE-2018-10868 | High | 7.5 | 2021-05-26 | redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "… |
CVE-2020-24665 | Medium | 6.5 | 2021-01-29 | The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remot… |
CVE-2021-23926 | Critical | 9.1 | 2021-01-14 | The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include po… |
CVE-2021-1267 | Medium | 4.3 | 2021-01-13 | A vulnerability in the dashboard widget of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cause a denial of… |
CVE-2012-3340 | Medium | 4.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authe… |
CVE-2020-24590 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. |
CVE-2020-11462 | High | 7.5 | 2020-05-04 | An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve… |
CVE-2020-3946 | High | 7.5 | 2020-04-20 | InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack… |
CVE-2020-2172 | Medium | 6.5 | 2020-04-07 | Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2012-6685 | High | 7.5 | 2020-02-19 | Nokogiri before 1.5.4 is vulnerable to XXE attacks |
CVE-2014-2228 | Critical | 9.8 | 2020-02-19 | The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages. |
CVE-2013-4335 | Critical | 9.8 | 2020-02-07 | opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities |
CVE-2020-6856 | Medium | 6.5 | 2020-02-06 | An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the serv… |
CVE-2019-20104 | High | 7.5 | 2020-02-06 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Servi… |
CVE-2020-5227 | Medium | 4.4 | 2020-01-28 | Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the av… |
CVE-2015-9541 | High | 7.5 | 2020-01-24 | Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-200… |
CVE-2017-18640 | High | 7.5 | 2019-12-12 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2019-11253 | High | 7.5 | 2019-10-17 | Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized us… |
CVE-2019-12401 | High | 7.5 | 2019-09-10 | Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler… |
CVE-2019-15903 | High | 7.5 | 2019-09-04 | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCu… |
CVE-2019-15160 | High | 7.5 | 2019-08-19 | The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity… |
CVE-2019-5442 | High | 7.5 | 2019-06-12 | XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is… |
CVE-2019-5427 | High | 7.5 | 2019-04-22 | c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion… |
CVE-2017-5644 | Medium | 5.5 | 2017-03-24 | Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an… |
CVE-2011-3288 | High | 7.5 | 2011-10-06 | Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (me… |
CVE-2011-1755 | High | 7.5 | 2011-06-21 | jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU c… |
CVE-2009-1955 | High | 7.5 | 2009-06-08 | The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache… |
CVE-2008-3281 | Medium | 6.5 | 2008-08-27 | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause… |
CVE-2003-1564 | Medium | 6.5 | 2003-12-31 | libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of servi… |