# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-123314.md)
  `CVE-2026-123314` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.1 Low · Not analysed yet · Published 6 Nov 2026 · Tags: XML external entities (XXE)
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3…](https://agentprime.io/advisories/CVE-2026-123312.md)
  `CVE-2026-123312` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 6 Nov 2026 · Tags: XML external entities (XXE)
- [Apache OFBiz: XML external entity injection (XXE)](https://agentprime.io/advisories/CVE-2026-81816.md)
  `CVE-2026-81816` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Wowza Streaming Engine](https://agentprime.io/advisories/CVE-2026-123029.md)
  `CVE-2026-123029` · CVE record: Wowza Streaming Engine · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: XML external entities (XXE)
- [IBM MQ Managed File Transfer is affected by a denial of service vulnerability](https://agentprime.io/advisories/CVE-2026-13271.md)
  `CVE-2026-13271` · CVE record: IBM MQ · CVSS 8.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: XML external entities (XXE)
- [IBM MQ Managed File Transfer is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-13284.md)
  `CVE-2026-13284` · CVE record: IBM MQ · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: XML external entities (XXE)
- [IBM MQ Managed File Transfer is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-13289.md)
  `CVE-2026-13289` · CVE record: IBM MQ · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: XML external entities (XXE)
- [XXE in TÜBİTAK BİLGEM's İmzager](https://agentprime.io/advisories/CVE-2026-19721.md)
  `CVE-2026-19721` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager · CVSS 3.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: XML external entities (XXE)
- [Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-92198.md)
  `CVE-2026-92198` · CVE record: Quest Foglight for Databases · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: XML external entities (XXE)
- [Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-92185.md)
  `CVE-2026-92185` · CVE record: Quest Foglight for Databases · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: XML external entities (XXE)
- [MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-114552.md)
  `CVE-2026-114552` · CVE record: MailEnable MailEnable · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: XML external entities (XXE)
- [XML External Entity injection in Szafir and Szafir Weryfikująca](https://agentprime.io/advisories/CVE-2026-93570.md)
  `CVE-2026-93570` · CVE record: Krajowa Izba Rozliczeniowa Szafir and 1 more · CVSS 8.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-66090.md)
  `CVE-2026-66090` · CVE record: Apereo Foundation openEQUELLA · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion](https://agentprime.io/advisories/CVE-2026-66089.md)
  `CVE-2026-66089` · CVE record: Apereo Foundation openEQUELLA · CVSS 6.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing](https://agentprime.io/advisories/CVE-2026-118039.md)
  `CVE-2026-118039` · CVE record: Progress Software Telerik Document Processing Libraries · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App](https://agentprime.io/advisories/CVE-2026-112198.md)
  `CVE-2026-112198` · CVE record: Tactis NoviGest Desktop App · CVSS 8.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: XML external entities (XXE)
- [PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service](https://agentprime.io/advisories/GHSA-3x94-m842-937c.md)
  `GHSA-3x94-m842-937c`, `CVE-2026-108358`, `PKSA-96jv-mtjg-g2v8` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `1.30.7`, `2.1.19`, `2.4.8`, `3.10.8`, `5.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: XML external entities (XXE), Denial of service
- [PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service](https://agentprime.io/advisories/GHSA-rxj4-h86g-25gc.md)
  `GHSA-rxj4-h86g-25gc`, `CVE-2026-108357`, `PKSA-zb3c-6qhx-m249` · Packagist `phpoffice/phpspreadsheet`: affected `>=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `3.10.8`, `5.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: XML external entities (XXE), Denial of service
- [Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entit…](https://agentprime.io/advisories/CVE-2026-90885.md)
  `CVE-2026-90885` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: XML external entities (XXE)
- [Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)](https://agentprime.io/advisories/CVE-2026-54668.md)
  `CVE-2026-54668` · CVE record: kitodo kitodo-production · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: XML external entities (XXE)
- [Apache Abdera: XML external entity expansion in Atom document parsing](https://agentprime.io/advisories/CVE-2026-113582.md)
  `CVE-2026-113582` · CVE record: Apache Software Foundation Apache Abdera · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: XML external entities (XXE)
- [jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)](https://agentprime.io/advisories/CVE-2026-97400.md)
  `CVE-2026-97400` · CVE record: Eclipse Foundation Eclipse OpenJ9 · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: XML external entities (XXE), CWE-618
- [Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present](https://agentprime.io/advisories/CVE-2026-91858.md)
  `CVE-2026-91858` · CVE record: Apache Software Foundation Apache Camel · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: XML external entities (XXE)
- [Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default](https://agentprime.io/advisories/CVE-2026-88901.md)
  `CVE-2026-88901` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: XML external entities (XXE)
- [Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option](https://agentprime.io/advisories/CVE-2026-85250.md)
  `CVE-2026-85250` · CVE record: Apache Software Foundation Apache Camel · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Yamaha Corporation VOCALOID6 Editor](https://agentprime.io/advisories/CVE-2026-104679.md)
  `CVE-2026-104679` · CVE record: Yamaha Corporation VOCALOID6 Editor · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: XML external entities (XXE)
- [XML External Entity injection in Sparx Enterprise Architect](https://agentprime.io/advisories/CVE-2026-88794.md)
  `CVE-2026-88794` · CVE record: Sparx Systems Enterprise Architect · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: XML external entities (XXE)
- [Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection](https://agentprime.io/advisories/CVE-2026-109430.md)
  `CVE-2026-109430` · CVE record: Ellucian WebAdvisor · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: XML external entities (XXE)
- [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2026-106616.md)
  `CVE-2026-106616` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: XML external entities (XXE)
- [Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2026-90531.md)
  `CVE-2026-90531` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: XML external entities (XXE)
- [CVFS Information Disclosure](https://agentprime.io/advisories/CVE-2026-77090.md)
  `CVE-2026-77090` · CVE record: Commvault Commvault Cloud and 1 more · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: XML external entities (XXE)
- [Security Vulnerability identified in IBM TRIRIGA - XXE](https://agentprime.io/advisories/CVE-2026-93891.md)
  `CVE-2026-93891` · CVE record: IBM TRIRIGA Application Platform · CVSS 7.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: XML external entities (XXE)
- [Improper XML external entity restriction in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-85970.md)
  `CVE-2026-85970` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: XML external entities (XXE)
- [Improper XML external entity restriction in Progress MarkLogic Server SAML processing](https://agentprime.io/advisories/CVE-2026-85957.md)
  `CVE-2026-85957` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Eclipse Foundation jaxb-ri (core)](https://agentprime.io/advisories/CVE-2026-92877.md)
  `CVE-2026-92877` · CVE record: Eclipse Foundation jaxb-ri (core) · CVSS 8.3 High · Not analysed yet · Published 12 Oct 2026 · Tags: XML external entities (XXE)
- [IBM DataPower Gateway XXE](https://agentprime.io/advisories/CVE-2026-14905.md)
  `CVE-2026-14905` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 8.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: XML external entities (XXE)
- [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102155.md)
  `CVE-2026-102155` · CVE record: Arista Networks CloudVision CUE · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: XML external entities (XXE)
- [Newell Brands DYMO ID document parsing failing file type extension authentication check](https://agentprime.io/advisories/CVE-2026-101893.md)
  `CVE-2026-101893` · CVE record: Newell Brands DYMO ID · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: XML external entities (XXE)
- [Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution](https://agentprime.io/advisories/GHSA-xm28-xvqc-gxxg.md)
  `GHSA-xm28-xvqc-gxxg`, `CVE-2026-61586` · Maven `eu.copernik:copernik-xml-factory`: affected `<0.1.2`, fixed in `0.1.2` · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: XML external entities (XXE)
- [Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening](https://agentprime.io/advisories/CVE-2026-88789.md)
  `CVE-2026-88789` · CVE record: Apache Software Foundation Apache Camel Quarkus · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: XML external entities (XXE)
- [Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2026-102127.md)
  `CVE-2026-102127` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.0 High · Not analysed yet · Published 30 Sept 2026 · Tags: XML external entities (XXE)
- [Apache Roller: XML external entity processing in trackback response parser](https://agentprime.io/advisories/CVE-2026-82376.md)
  `CVE-2026-82376` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: XML external entities (XXE)
- [Apache Roller: XML external entity processing in OPML bookmark import](https://agentprime.io/advisories/CVE-2026-82386.md)
  `CVE-2026-82386` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in IBM Financial Transaction Manager (FTM) for Redhat OpenShift](https://agentprime.io/advisories/CVE-2026-93030.md)
  `CVE-2026-93030` · CVE record: IBM IBM Financial Transaction Manager (FTM) for Redhat OpenShift · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: XML external entities (XXE)
- [http4s-scala-xml has an XML External Entity (XXE) processing issue](https://agentprime.io/advisories/GHSA-cjx3-73hr-rpw7.md)
  `GHSA-cjx3-73hr-rpw7`, `CVE-2026-61741` · Maven `org.http4s:http4s-scala-xml_2.12` and 2 more: affected `<0.24.1`, fixed in `0.24.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: XML external entities (XXE)
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81536.md)
  `CVE-2026-81536` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: XML external entities (XXE)
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18184.md)
  `CVE-2026-18184` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: XML external entities (XXE)
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18172.md)
  `CVE-2026-18172` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 7.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: XML external entities (XXE)
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17646.md)
  `CVE-2026-17646` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: XML external entities (XXE)
- [MPXJ: XXE Vulnerability in MerlinReader](https://agentprime.io/advisories/GHSA-5vvx-3h34-f3gj.md)
  `GHSA-5vvx-3h34-f3gj`, `CVE-2026-61570`, `PYSEC-2026-4107` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=5.5.5, <16.4.1`, fixed in `16.4.1` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: XML external entities (XXE)
- [getID3 through 1.9.26 XML External Entity Injection via XML2array](https://agentprime.io/advisories/CVE-2026-94108.md)
  `CVE-2026-94108` · CVE record: james-heinrich getid3 · CVSS 8.3 High · Not analysed yet · Published 20 Sept 2026 · Tags: XML external entities (XXE)
- [Cisco ISE XML External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76427.md)
  `CVE-2026-76427` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: XML external entities (XXE)
- [Cisco Identity Services Engine External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76446.md)
  `CVE-2026-76446` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: XML external entities (XXE)
- [IBM MQ Java messaging is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-12666.md)
  `CVE-2026-12666` · CVE record: IBM MQ · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: XML external entities (XXE)
- [IBM MQ .NET client is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-12667.md)
  `CVE-2026-12667` · CVE record: IBM MQ · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: XML external entities (XXE)
- [Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026](https://agentprime.io/advisories/CVE-2026-12752.md)
  `CVE-2026-12752` · CVE record: IBM Business Automation Workflow containers and traditional · CVSS 7.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: XML external entities (XXE)
- [Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory](https://agentprime.io/advisories/CVE-2026-91197.md)
  `CVE-2026-91197` · CVE record: flowable flowable-engine · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: XML external entities (XXE)
- [Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026](https://agentprime.io/advisories/CVE-2026-12756.md)
  `CVE-2026-12756` · CVE record: IBM Business Automation Workflow containers and traditional · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: XML external entities (XXE)
- [IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-13265.md)
  `CVE-2026-13265` · CVE record: IBM MQ · CVSS 6.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: XML external entities (XXE)
- [IBM MQ Managed File Transfer is vulnerable to XML external entity injection](https://agentprime.io/advisories/CVE-2026-13275.md)
  `CVE-2026-13275` · CVE record: IBM MQ · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: XML external entities (XXE)

Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDI2LTA5LTE0VDIxOjEwOjI1LjU1ODAwMFoiLCJDVkUtMjAyNi0xMzI3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/>. Everything for agents: <https://agentprime.io/llms.txt>.