Browse CVEs

MEDIUM 5.5 CVE-2026-6807 A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposur… Mitigation only Fix from $1,6002026-04-28 HIGH 7.5 CVE-2026-41066 lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (w… Lxml 6.1.0+ Fix from $1,9502026-04-24 HIGH 7.6 CVE-2026-40882 OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML withou… Openremote 1.22.0+ Fix from $1,9502026-04-22 HIGH 7.5 CVE-2026-22016 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supporte… Jre Mitigation only Fix from $1,9502026-04-21 HIGH 7.5 CVE-2024-8010 The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted … Api Manager 3.2.0.397 / 3.2.1.27+ Fix from $1,9502026-04-16 CRITICAL 9.1 CVE-2024-2374 The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entiti… Api Manager 2.0.0.328 / 2.0.0.348+ Fix from $2,3002026-04-16 HIGH 7.5 CVE-2026-26171 Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. .net 7.5.6 / 7.6.1+ Fix from $1,9502026-04-14 MEDIUM 6.5 CVE-2026-33737 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With… Chamilo Lms 1.11.38+ Fix from $1,6002026-04-10 CRITICAL 9.1 CVE-2026-4374 Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Cloud Discovery Service, Recording Service, Routing … Connext Professional 7.3.1.1 / 7.7.0+ Fix from $2,3002026-04-01 MEDIUM 6.5 CVE-2026-34401 XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, X… Xml Notepad 2.9.0.21+ Fix from $1,6002026-03-31 HIGH 7.6 CVE-2026-29924 Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager p… Grav 1.8.0+ Fix from $1,9502026-03-30 MEDIUM 6.3 CVE-2026-4980 A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files vi… Inkscape 1.3+ Fix from $1,6002026-03-27 MEDIUM 5.3 CVE-2026-28809 XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their con… Esaml after 4.6.0 Fix from $1,6002026-03-23 HIGH 8.6 CVE-2026-3511 Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated atta… Mitigation only Fix from $1,9502026-03-19 MEDIUM 6.5 CVE-2026-32251 Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don… Tolgee 3.166.3+ Fix from $1,6002026-03-12 HIGH 7.5 CVE-2026-1567 IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 An XML External Entity (XXE) vulnerability in IBM InfoSphere Information Server could all… Infosphere Information Server after 11.7.1.6 Fix from $1,9502026-03-03 HIGH 8.1 CVE-2026-3404 A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java … Jeesite after 5.15.1 Fix from $1,9502026-03-02 HIGH 7.5 CVE-2026-2252 An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malic… Freeflow Core 8.1.0+ Fix from $1,9502026-02-27 HIGH 8.2 CVE-2025-36247 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external en… Db2 after 12.1.3 Fix from $1,9502026-02-17 MEDIUM 6.3 CVE-2026-2536 A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admi… Mitigation only Fix from $1,6002026-02-16 MEDIUM 6.2 CVE-2020-37192 MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted X… No fix yet Fix from $1,6002026-02-11 HIGH 7.0 CVE-2026-1227 CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interact… Mitigation only Fix from $1,9502026-02-11 MEDIUM 6.3 CVE-2026-2074 A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the compon… O2oa after 9.0.0 Fix from $1,6002026-02-07 MEDIUM 6.5 CVE-2026-23739 Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast… Asterisk 20.18.2 / 21.12.1+ Fix from $1,6002026-02-06 HIGH 7.9 CVE-2026-21569 This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (X… Crowd 7.1.3+ Fix from $1,9502026-01-28 CRITICAL 9.1 CVE-2026-24400 AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML… Assertj 3.27.7+ Fix from $2,3002026-01-26 CRITICAL 9.8 CVE-2025-65482 An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a craft… Xdocreport after 2.0.3 Fix from $2,3002026-01-20 MEDIUM 6.3 CVE-2026-1218 A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the componen… Mitigation only Fix from $1,6002026-01-20 HIGH 7.5 CVE-2025-14478 The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the … Mitigation only Fix from $1,9502026-01-17 MEDIUM 6.5 CVE-2022-50899 Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from t… Geonetwork after 4.2.0 Fix from $1,6002026-01-13