# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c](https://agentprime.io/advisories/CVE-2026-48981.md)
  `CVE-2026-48981` · CVE record: mcdope pam_usb · CVSS 6.7 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: XML external entities (XXE)
- [HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory](https://agentprime.io/advisories/GHSA-2f55-g35j-5jmf.md)
  `GHSA-2f55-g35j-5jmf`, `CVE-2026-55471` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.utilities`: affected `<6.9.10`, fixed in `6.9.10` · CVSS 8.7 High · Not analysed yet · Published 17 Jun 2026 · Tags: XML external entities (XXE)
- [GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution](https://agentprime.io/advisories/GHSA-x4r9-gmw3-hxww.md)
  `GHSA-x4r9-gmw3-hxww`, `CVE-2025-58175` · Maven `org.geoserver:gs-main` and 1 more: affected `<2.26.4 || >=2.27.0, <2.27.3`, fixed in `2.26.4`, `2.27.3` · CVSS 6.5 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: XML external entities (XXE), Server-side request forgery (SSRF), CWE-20
- [Apache CXF has Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-xw5h-cmh3-8j6j.md)
  `GHSA-xw5h-cmh3-8j6j`, `CVE-2026-49875` · Maven `org.apache.cxf:cxf-core`: affected `>=4.2.0, <4.2.2 || >=4.0.0, <4.1.7 || <3.6.12`, fixed in `4.2.2`, `4.1.7`, `3.6.12` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: XML external entities (XXE)
- [Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource](https://agentprime.io/advisories/GHSA-2mpf-m756-hxjm.md)
  `GHSA-2mpf-m756-hxjm`, `CVE-2026-40998` · Maven `org.springframework.ws:spring-xml`: affected `>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8`, fixed in `5.0.2`, `4.1.4` · CVSS 8.2 High · Not analysed yet · Published 11 Jun 2026 · Tags: XML external entities (XXE)
- [Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-6rpq-6vv2-5222.md)
  `GHSA-6rpq-6vv2-5222`, `CVE-2026-40991` · Maven `org.springframework.restdocs:spring-restdocs-restassured` and 1 more: affected `>=4.0.0, <4.0.1 || >=3.0.0, <3.0.6 || <=2.0.8.RELEASE`, fixed in `4.0.1`, `3.0.6` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: XML external entities (XXE)
- [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2026-47960.md)
  `CVE-2026-47960` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.4 High · Not analysed yet · Published 9 Jun 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Schneider Electric EcoStruxure™ IT Data Center Expert](https://agentprime.io/advisories/CVE-2026-8045.md)
  `CVE-2026-8045` · CVE record: Schneider Electric EcoStruxure™ IT Data Center Expert · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: XML external entities (XXE)
- [Docling: Unsafe XML Entity Expansion in USPTO Patent Backend](https://agentprime.io/advisories/GHSA-m88r-rg27-5xfg.md)
  `GHSA-m88r-rg27-5xfg`, `CVE-2026-44020`, `PYSEC-2026-240` · PyPI `docling`: affected `>=2.13.0, <2.74.0`, fixed in `2.74.0` · CVSS 7.5 High · Not analysed yet · Published 3 Jun 2026 · Tags: XML external entities (XXE), Denial of service
- [Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend](https://agentprime.io/advisories/GHSA-r3xg-rg9j-67fv.md)
  `GHSA-r3xg-rg9j-67fv`, `CVE-2026-44018`, `PYSEC-2026-2144` · PyPI `docling`: affected `>=2.45.0, <2.91.0`, fixed in `2.91.0` · CVSS 5.5 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: XML external entities (XXE), Denial of service, CWE-409
- [XML external entity injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49383.md)
  `CVE-2026-49383` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 29 May 2026 · Tags: XML external entities (XXE)
- [Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true](https://agentprime.io/advisories/GHSA-x6g4-fwcc-jj8w.md)
  `GHSA-x6g4-fwcc-jj8w`, `CVE-2026-45071`, `PKSA-5r1g-c7b7-y1zg`, `PKSA-9ss4-yr44-h3bt` · Packagist `symfony/dom-crawler` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2026-2253.md)
  `CVE-2026-2253` · CVE record: Hitachi Vantara Pentaho Data Integration and Analytics · CVSS 7.7 High · Not analysed yet · Published 27 May 2026 · Tags: XML external entities (XXE)
- [IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack](https://agentprime.io/advisories/CVE-2026-3603.md)
  `CVE-2026-3603` · CVE record: IBM Engineering Lifecycle Management · CVSS 7.1 High · Not analysed yet · Published 26 May 2026 · Tags: XML external entities (XXE)
- [Apache CXF's WS-Transfer module has an insecure XML parser configuration](https://agentprime.io/advisories/GHSA-vmm5-fjgx-2jhp.md)
  `GHSA-vmm5-fjgx-2jhp`, `CVE-2026-44618` · Maven `org.apache.cxf:cxf-rt-ws-transfer`: affected `>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11`, fixed in `4.2.1`, `4.1.6`, `3.6.11` · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: XML external entities (XXE)
- [TYPO3 ke_search XML External Entity Injection](https://agentprime.io/advisories/GHSA-fq39-62gx-8hqx.md)
  `GHSA-fq39-62gx-8hqx`, `CVE-2026-46722`, `PKSA-cy57-p12b-t759` · Packagist `tpwd/ke_search`: affected `<4.6.7 || >=5.0.0, <5.6.2 || >=6.0.0, <6.6.1 || >=7.0.0, <7.0.1`, fixed in `4.6.7`, `5.6.2`, `6.6.1`, `7.0.1` · CVSS 5.9 Medium · Not analysed yet · Published 19 May 2026 · Tags: XML external entities (XXE)
- [Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic.](https://agentprime.io/advisories/CVE-2026-39053.md)
  `CVE-2026-39053` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 15 May 2026 · Tags: XML external entities (XXE)
- [ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module](https://agentprime.io/advisories/CVE-2026-44445.md)
  `CVE-2026-44445` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: XML external entities (XXE)
- [SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser](https://agentprime.io/advisories/CVE-2026-42212.md)
  `CVE-2026-42212` · CVE record: anzory SolidCAM-GPPL-IDE · CVSS 7.1 High · Not analysed yet · Published 8 May 2026 · Tags: Denial of service, XML external entities (XXE)
- [fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes](https://agentprime.io/advisories/GHSA-5wm8-gmm8-39j9.md)
  `GHSA-5wm8-gmm8-39j9`, `CVE-2026-44665` · npm `fast-xml-builder`: affected `<1.1.7`, fixed in `1.1.7` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Other injection, XML external entities (XXE)
- [Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information](https://agentprime.io/advisories/GHSA-rcc6-6q2f-m2cw.md)
  `GHSA-rcc6-6q2f-m2cw`, `CVE-2023-42344` · Maven `org.opencms:opencms-core`: affected `<10.5.1`, fixed in `10.5.1` · CVSS 7.3 High · Not analysed yet · Published 8 May 2026 · Tags: XML external entities (XXE)
- [Alkacon OpenCms is vulnerable to XXE when the \<!DOCTYPE> refers to an external host](https://agentprime.io/advisories/GHSA-pj6p-9p8x-5mfc.md)
  `GHSA-pj6p-9p8x-5mfc`, `CVE-2023-42346` · Maven `org.opencms:opencms-core`: affected `<16.0`, fixed in `16.0` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: XML external entities (XXE)
- [Vvveb < 1.0.8.2 XML External Entity Injection via Import](https://agentprime.io/advisories/CVE-2026-41936.md)
  `CVE-2026-41936` · CVE record: givanz Vvveb · CVSS 8.6 High · Not analysed yet · Published 6 May 2026 · Tags: XML external entities (XXE)
- [Grav is Vulnerable to XXE via SVG Upload](https://agentprime.io/advisories/GHSA-3446-6mgw-f79p.md)
  `GHSA-3446-6mgw-f79p`, `CVE-2026-56701`, `PKSA-59xg-9744-g5wz` · Packagist `getgrav/grav`: affected `<2.0.0-beta.2`, fixed in `2.0.0-beta.2` · CVSS 7.1 High · Not analysed yet · Published 5 May 2026 · Tags: XML external entities (XXE)
- [OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.](https://agentprime.io/advisories/CVE-2026-38429.md)
  `CVE-2026-38429` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: XML external entities (XXE)
- [changedetection.io project has an XXE vulnerability](https://agentprime.io/advisories/GHSA-v7cp-2cx9-x793.md)
  `GHSA-v7cp-2cx9-x793`, `CVE-2026-41895`, `PYSEC-2026-29` · PyPI `changedetection-io`: affected `<=0.54.9`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 4 May 2026 · Tags: XML external entities (XXE)
- [Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing](https://agentprime.io/advisories/GHSA-4v8g-86x5-3vrc.md)
  `GHSA-4v8g-86x5-3vrc`, `CVE-2026-40682` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5`, fixed in `2.5.9`, `3.0.0-M3`, `1.9.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: XML external entities (XXE)
- [jOpenDocument has an improper restriction of XML external entity reference vulnerability](https://agentprime.io/advisories/GHSA-j9rh-p96m-mhhp.md)
  `GHSA-j9rh-p96m-mhhp`, `CVE-2026-6501` · Maven `org.jopendocument:jOpenDocument`: affected `<=1.3`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.](https://agentprime.io/advisories/CVE-2025-14543.md)
  `CVE-2025-14543` · CVE record: RTI Connext Professional · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2026 · Tags: XML external entities (XXE)
- [Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro](https://agentprime.io/advisories/CVE-2024-13971.md)
  `CVE-2024-13971` · CVE record: Lobster GmbH Lobster_pro · CVSS 7.7 High · Not analysed yet · Published 30 Apr 2026 · Tags: XML external entities (XXE)
- [Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP](https://agentprime.io/advisories/CVE-2024-39847.md)
  `CVE-2024-39847` · CVE record: 4D 4D Server · CVSS 8.7 High · Not analysed yet · Published 30 Apr 2026 · Tags: XML external entities (XXE)
- [An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.](https://agentprime.io/advisories/CVE-2026-36765.md)
  `CVE-2026-36765` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2026 · Tags: XML external entities (XXE)
- [NSA GRASSMARLIN Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2026-6807.md)
  `CVE-2026-6807` · CVE record: NSA GRASSMARLIN · CVSS 5.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: XML external entities (XXE)
- [lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files](https://agentprime.io/advisories/GHSA-vfmq-68hx-4jfw.md)
  `GHSA-vfmq-68hx-4jfw`, `CVE-2026-41066`, `PYSEC-2026-87` · PyPI `lxml`: affected `<6.1.0`, fixed in `6.1.0` · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: XML external entities (XXE)
- [Information disclosure in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-22016.md)
  `CVE-2026-22016` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure, Insecure deserialization, XML external entities (XXE)
- [XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files](https://agentprime.io/advisories/CVE-2024-8010.md)
  `CVE-2024-8010` · CVE record: WSO2 WSO2 API Manager · CVSS 3.5 Low · Not analysed yet · Published 16 Apr 2026 · Tags: XML external entities (XXE)
- [XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service](https://agentprime.io/advisories/CVE-2024-2374.md)
  `CVE-2024-2374` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: XML external entities (XXE)
- [OpenRemote has XXE in Velbus Asset Import](https://agentprime.io/advisories/GHSA-g24f-mgc3-jwwc.md)
  `GHSA-g24f-mgc3-jwwc`, `CVE-2026-40882` · Maven `io.openremote:openremote-manager`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 7.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: XML external entities (XXE)
- [Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-w3x6-4m5h-cxqf.md)
  `GHSA-w3x6-4m5h-cxqf`, `BIT-dotnet-2026-26171`, `BIT-dotnet-sdk-2026-26171`, `BIT-powershell-2026-26171`, `CVE-2026-26171` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.3 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6`, fixed in `8.0.3`, `9.0.15`, `10.0.6` · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: Denial of service, XML external entities (XXE)
- [Chamilo LMS has an XML External Entity (XXE) Injection](https://agentprime.io/advisories/CVE-2026-33737.md)
  `CVE-2026-33737` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) al…](https://agentprime.io/advisories/CVE-2026-4374.md)
  `CVE-2026-4374` · CVE record: RTI Connext Professional · CVSS 8.8 High · Not analysed yet · Published 1 Apr 2026 · Tags: XML external entities (XXE)
- [XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading](https://agentprime.io/advisories/CVE-2026-34401.md)
  `CVE-2026-34401` · CVE record: microsoft XmlNotepad · CVSS 6.5 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: XML external entities (XXE)
- [Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.](https://agentprime.io/advisories/CVE-2026-29924.md)
  `CVE-2026-29924` · CVE record · CVSS 7.6 High · Not analysed yet · Published 30 Mar 2026 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Inkscape](https://agentprime.io/advisories/CVE-2026-4980.md)
  `CVE-2026-4980` · CVE record: Inkscape Inkscape · CVSS 6.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: XML external entities (XXE)
- [OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files](https://agentprime.io/advisories/CVE-2026-33913.md)
  `CVE-2026-33913` · CVE record: openemr openemr · CVSS 7.7 High · Not analysed yet · Published 25 Mar 2026 · Tags: XML external entities (XXE)
- [XXE in esaml SAML library allows local file read and potential SSRF](https://agentprime.io/advisories/GHSA-4g2h-vm7x-747c.md)
  `GHSA-4g2h-vm7x-747c`, `CVE-2026-28809`, `EEF-CVE-2026-28809` · Hex `esaml`: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: XML external entities (XXE)
- [An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.](https://agentprime.io/advisories/CVE-2026-33371.md)
  `CVE-2026-33371` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Slovensko.Digital Autogram](https://agentprime.io/advisories/CVE-2026-3511.md)
  `CVE-2026-3511` · CVE record: Slovensko.Digital Autogram · CVSS 8.6 High · Not analysed yet · Published 19 Mar 2026 · Tags: XML external entities (XXE)
- [Tolgee has an XXE Injection in Translation Import](https://agentprime.io/advisories/CVE-2026-32251.md)
  `CVE-2026-32251` · CVE record: tolgee tolgee-platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2026 · Tags: XML external entities (XXE)
- [IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability](https://agentprime.io/advisories/CVE-2026-1567.md)
  `CVE-2026-1567` · CVE record: IBM InfoSphere Information Server · CVSS 7.1 High · Not analysed yet · Published 3 Mar 2026 · Tags: XML external entities (XXE)
- [thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference](https://agentprime.io/advisories/CVE-2026-3404.md)
  `CVE-2026-3404` · CVE record: thinkgem JeeSite · CVSS 2.3 Low · Not analysed yet · Published 2 Mar 2026 · Tags: XML external entities (XXE), CWE-610
- [XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-2252.md)
  `CVE-2026-2252` · CVE record: Xerox FreeFlow Core · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2026 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [IBM Db2 XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-36247.md)
  `CVE-2025-36247` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 7.1 High · Not analysed yet · Published 17 Feb 2026 · Tags: XML external entities (XXE)
- [opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference](https://agentprime.io/advisories/CVE-2026-2536.md)
  `CVE-2026-2536` · CVE record: opencc JFlow · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: XML external entities (XXE), CWE-610
- [MSN Password Recovery 1.30 - XML External Entity Injection](https://agentprime.io/advisories/CVE-2020-37192.md)
  `CVE-2020-37192` · CVE record: Top Password Software MSN Password Recovery · CVSS 6.7 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Schneider Electric EcoStruxure Building Operation Workstation and others](https://agentprime.io/advisories/CVE-2026-1227.md)
  `CVE-2026-1227` · CVE record: Schneider Electric EcoStruxure Building Operation Workstation and 1 more · CVSS 7.0 High · Not analysed yet · Published 11 Feb 2026 · Tags: XML external entities (XXE)
- [O2OA HTTP POST Request check xml external entity reference](https://agentprime.io/advisories/CVE-2026-2074.md)
  `CVE-2026-2074` · CVE record: O2OA · CVSS 5.3 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: XML external entities (XXE), CWE-610
- [Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection](https://agentprime.io/advisories/CVE-2026-23739.md)
  `CVE-2026-23739` · CVE record: asterisk asterisk · CVSS 2.0 Low · Not analysed yet · Published 6 Feb 2026 · Tags: XML external entities (XXE)
- [Apache Syncope: Console XXE on Keymaster parameters](https://agentprime.io/advisories/GHSA-73f3-rqqf-2j54.md)
  `GHSA-73f3-rqqf-2j54`, `CVE-2026-23795` · Maven `org.apache.syncope.client.idrepo:syncope-client-idrepo-console`: affected `>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4`, fixed in `3.0.16`, `4.0.4` · CVSS 4.9 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: XML external entities (XXE)
- [XML external entity injection in Atlassian Crowd Data Center](https://agentprime.io/advisories/CVE-2026-21569.md)
  `CVE-2026-21569` · CVE record: Atlassian Crowd Data Center · CVSS 7.9 High · Not analysed yet · Published 28 Jan 2026 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDI2LTAxLTI4VDAwOjMwOjAwLjU1NzAwMFoiLCJDVkUtMjAyNi0yMTU2OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDI2LTA2LTE5VDE2OjM2OjExLjAwMDAwMFoiLCJHSFNBLTg2NzgtdzNqdy14ZmMyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDI2LTA2LTE5VDE2OjM2OjExLjAwMDAwMFoiLCJHSFNBLTg2NzgtdzNqdy14ZmMyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.