# XML external entities (XXE). XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion](https://agentprime.io/advisories/GHSA-rqfh-9r24-8c9r.md) `GHSA-rqfh-9r24-8c9r`, `CVE-2026-24400` · Maven `org.assertj:assertj-core`: affected `>=1.4.0, <3.27.7`, fixed in `3.27.7` · CVSS 8.2 High · Not analysed yet · Published 26 Jan 2026 · Tags: XML external entities (XXE) - [XDocReport affected by an XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-7jc7-g598-2p64.md) `GHSA-7jc7-g598-2p64`, `CVE-2025-65482` · Maven `fr.opensagres.xdocreport:fr.opensagres.xdocreport.document`: affected `>=0.9.2, <2.0.4`, fixed in `2.0.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: XML external entities (XXE) - [Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference](https://agentprime.io/advisories/CVE-2026-1218.md) `CVE-2026-1218` · CVE record: Bjskzy Zhiyou ERP · CVSS 5.3 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: XML external entities (XXE), CWE-610 - [Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload](https://agentprime.io/advisories/CVE-2025-14478.md) `CVE-2025-14478` · CVE record: kraftplugins Demo Importer Plus · CVSS 7.5 High · Not analysed yet · Published 17 Jan 2026 · Tags: XML external entities (XXE) - [Geonetwork 4.2.0 - XML External Entity (XXE)](https://agentprime.io/advisories/CVE-2022-50899.md) `CVE-2022-50899` · CVE record: GeoNetwork GeoNetwork · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: XML external entities (XXE) - [Apache Struts 2 is Missing XML Validation](https://agentprime.io/advisories/GHSA-qcfc-hmrc-59x7.md) `GHSA-qcfc-hmrc-59x7`, `CVE-2025-68493` · Maven `com.opensymphony:xwork` and 2 more: affected `>=2.0.0`, no fixed version yet · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 11 Jan 2026 · Tags: XML external entities (XXE), CWE-112 - [Bio-Formats has an XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-fcqj-76g3-q7qm.md) `GHSA-fcqj-76g3-q7qm`, `CVE-2026-22186`, `GHSA-x9vc-qh97-8gjp` · Maven `ome:pom-bio-formats`: affected `<=8.3.0`, no fixed version yet · CVSS 4.6 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: XML external entities (XXE) - [Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-20029.md) `CVE-2026-20029` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.9 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: XML external entities (XXE) - [XML external entity injection in Dell Unisphere for PowerMax](https://agentprime.io/advisories/CVE-2025-36589.md) `CVE-2025-36589` · CVE record: Dell Unisphere for PowerMax · CVSS 7.6 High · Not analysed yet · Published 6 Jan 2026 · Tags: XML external entities (XXE) - [Apache SIS has Improper Restriction of XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-jqmr-2pg9-vfx7.md) `GHSA-jqmr-2pg9-vfx7`, `CVE-2025-68280` · Maven `org.apache.sis.core:sis-metadata`: affected `>=0.4, <1.6`, fixed in `1.6` · CVSS 6.5 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: XML external entities (XXE) - [beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference](https://agentprime.io/advisories/CVE-2025-15251.md) `CVE-2025-15251` · CVE record: beecue FastBee · CVSS 6.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: XML external entities (XXE), CWE-610 - [KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection](https://agentprime.io/advisories/CVE-2019-25253.md) `CVE-2019-25253` · CVE record: KYOCERA Corporation KYOCERA Net Admin · CVSS 7.1 High · Not analysed yet · Published 24 Dec 2025 · Tags: XML external entities (XXE) - [NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection](https://agentprime.io/advisories/CVE-2018-25142.md) `CVE-2018-25142` · CVE record: NovaRad Corporation NovaPACS Diagnostics Viewer · CVSS 7.1 High · Not analysed yet · Published 24 Dec 2025 · Tags: XML external entities (XXE) - [XML external entity injection in jcthiele OpenXRechnungToolbox](https://agentprime.io/advisories/CVE-2024-58335.md) `CVE-2024-58335` · CVE record: jcthiele OpenXRechnungToolbox · CVSS 5.0 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: XML external entities (XXE) - [Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez](https://agentprime.io/advisories/GHSA-x3vf-39hj-gxr4.md) `GHSA-x3vf-39hj-gxr4`, `CVE-2025-68463`, `PYSEC-2026-1221` · PyPI `biopython`: affected `<=1.86`, no fixed version yet · CVSS 4.9 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61813.md) `CVE-2025-61813` · CVE record: Adobe ColdFusion · CVSS 7.4 High · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61821.md) `CVE-2025-61821` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61823.md) `CVE-2025-61823` · CVE record: Adobe ColdFusion · CVSS 6.2 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [Apache Tika has XXE vulnerability](https://agentprime.io/advisories/GHSA-f58c-gq56-vjjf.md) `GHSA-f58c-gq56-vjjf`, `CVE-2025-66516` · Maven `org.apache.tika:tika-core` and 2 more: affected `>=1.13, <3.2.2`, fixed in `3.2.2` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 4 Dec 2025 · Tags: XML external entities (XXE) - [XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.](https://agentprime.io/advisories/CVE-2025-65868.md) `CVE-2025-65868` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Dec 2025 · Tags: XML external entities (XXE) - [Mustangproject allows exfiltrating files via XXE attacks](https://agentprime.io/advisories/GHSA-x832-fpvj-r5ph.md) `GHSA-x832-fpvj-r5ph`, `CVE-2025-66372` · Maven `org.mustangproject:library` and 1 more: affected `<2.16.3`, fixed in `2.16.3` · CVSS 2.8 Low · Not analysed yet · Published 28 Nov 2025 · Tags: XML external entities (XXE) - [Peppol-py is vulnerable to XXE attacks due to Saxon configuration](https://agentprime.io/advisories/GHSA-24hm-wm2h-h8w7.md) `GHSA-24hm-wm2h-h8w7`, `CVE-2025-66371`, `PYSEC-2026-1765` · PyPI `peppol-py`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 5.0 Medium · Not analysed yet · Published 28 Nov 2025 · Tags: XML external entities (XXE) - [XML external entity injection in kivitendo](https://agentprime.io/advisories/CVE-2025-66370.md) `CVE-2025-66370` · CVE record: kivitendo kivitendo · CVSS 5.0 Medium · Not analysed yet · Published 28 Nov 2025 · Tags: XML external entities (XXE) - [GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature](https://agentprime.io/advisories/GHSA-fjf5-xgmq-5525.md) `GHSA-fjf5-xgmq-5525`, `CVE-2025-58360` · Maven `org.geoserver:gs-wms` and 1 more: affected `>=2.26.0, <2.26.2 || <2.25.6`, fixed in `2.26.2`, `2.25.6` · CVSS 8.2 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.61 · Not analysed yet · Published 25 Nov 2025 · Tags: XML external entities (XXE) - [PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references.](https://agentprime.io/advisories/CVE-2025-63917.md) `CVE-2025-63917` · CVE record · CVSS 7.1 High · Not analysed yet · Published 17 Nov 2025 · Tags: XML external entities (XXE) - [bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference](https://agentprime.io/advisories/CVE-2025-13209.md) `CVE-2025-13209` · CVE record: bestfeng oa_git_free · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: XML external entities (XXE), CWE-610 - [N-central Multiple XXE Injection Vulnerabilities](https://agentprime.io/advisories/CVE-2025-11700.md) `CVE-2025-11700` · CVE record: N-able N-central · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 12 Nov 2025 · Tags: XML external entities (XXE) - [CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection](https://agentprime.io/advisories/GHSA-6fhj-vr9j-g45r.md) `GHSA-6fhj-vr9j-g45r`, `CVE-2025-64518` · Maven `org.cyclonedx:cyclonedx-core-java`: affected `>=2.1.0, <11.0.1`, fixed in `11.0.1` · CVSS 7.5 High · Not analysed yet · Published 10 Nov 2025 · Tags: XML external entities (XXE) - [A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.](https://agentprime.io/advisories/CVE-2025-63551.md) `CVE-2025-63551` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF) - [WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks](https://agentprime.io/advisories/GHSA-fvfq-q238-j7j3.md) `GHSA-fvfq-q238-j7j3`, `CVE-2025-10713` · Maven `org.wso2.carbon.mediation:org.wso2.carbon.localentry`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: XML external entities (XXE) - [IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability](https://agentprime.io/advisories/CVE-2025-12531.md) `CVE-2025-12531` · CVE record: IBM InfoSphere Information Server · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2025 · Tags: XML external entities (XXE) - [Jenkins JDepend Plugin vulnerable to XML external entity attacks](https://agentprime.io/advisories/GHSA-jfg6-4gx3-3v7w.md) `GHSA-jfg6-4gx3-3v7w`, `CVE-2025-64134` · Maven `org.jenkins-ci.plugins:jdepend`: affected `<=1.3.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Dell Storage Manager](https://agentprime.io/advisories/CVE-2025-46425.md) `CVE-2025-46425` · CVE record: Dell Dell Storage Manager · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: XML external entities (XXE) - [LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing](https://agentprime.io/advisories/GHSA-m42m-m8cr-8m58.md) `GHSA-m42m-m8cr-8m58`, `CVE-2025-6985`, `PYSEC-2026-1520` · PyPI `langchain-text-splitters`: affected `<0.3.9`, fixed in `0.3.9` · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2025 · Tags: XML external entities (XXE) - [Jinher OA type xml external entity reference](https://agentprime.io/advisories/CVE-2025-11341.md) `CVE-2025-11341` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: XML external entities (XXE), CWE-610 - [XML external entity injection in Saison Technology Co.,Ltd. DataSpider Servista](https://agentprime.io/advisories/CVE-2025-48006.md) `CVE-2025-48006` · CVE record: Saison Technology Co.,Ltd. DataSpider Servista · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2025 · Tags: XML external entities (XXE) - [Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference](https://agentprime.io/advisories/CVE-2025-11140.md) `CVE-2025-11140` · CVE record: Bjskzy Zhiyou ERP · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: XML external entities (XXE), CWE-610 - [Jinher OA text xml external entity reference](https://agentprime.io/advisories/CVE-2025-11035.md) `CVE-2025-11035` · CVE record: Jinher OA · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: XML external entities (XXE), CWE-610 - [Jinher OA XML text xml external entity reference](https://agentprime.io/advisories/CVE-2025-10816.md) `CVE-2025-10816` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: XML external entities (XXE), CWE-610 - [XML External Entity Injection in TecConnect 4.1](https://agentprime.io/advisories/CVE-2025-10183.md) `CVE-2025-10183` · CVE record: TecCom TecConnect · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: XML external entities (XXE) - [Jinher OA XML Type xml external entity reference](https://agentprime.io/advisories/CVE-2025-10092.md) `CVE-2025-10092` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: XML external entities (XXE), CWE-610 - [Jinher OA XML Type xml external entity reference](https://agentprime.io/advisories/CVE-2025-10091.md) `CVE-2025-10091` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: XML external entities (XXE), CWE-610 - [Langchain Community Vulnerable to XML External Entity (XXE) Attacks](https://agentprime.io/advisories/GHSA-pc6w-59fv-rh23.md) `GHSA-pc6w-59fv-rh23`, `CVE-2025-6984`, `PYSEC-2026-1515` · PyPI `langchain-community`: affected `<0.3.27`, fixed in `0.3.27` · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2025 · Tags: Information disclosure, XML external entities (XXE) - [Sangfor Behavior Management System XML External Entity Injection](https://agentprime.io/advisories/CVE-2023-7307.md) `CVE-2023-7307` · CVE record: Sangfor Technologies Co. Ltd. Sangfor Behavior Management System (DC Management System) · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2025 · Tags: XML external entities (XXE) - [Agiloft XML external entity local path traversal](https://agentprime.io/advisories/CVE-2025-35112.md) `CVE-2025-35112` · CVE record: Agiloft Agiloft · CVSS 5.1 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: XML external entities (XXE) - [EIP Builder XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-57704.md) `CVE-2025-57704` · CVE record: Delta Electronics EIP Builder · CVSS 5.5 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: XML external entities (XXE) - [Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF](https://agentprime.io/advisories/GHSA-p72g-pv48-7w9x.md) `GHSA-p72g-pv48-7w9x`, `CVE-2025-54988` · Maven `org.apache.tika:tika-parser-pdf-module` and 1 more: affected `>=1.13, <3.2.2`, fixed in `3.2.2` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 20 Aug 2025 · Tags: XML external entities (XXE) - [XML External Entity Injection vulnerability in various Lexmark Universal Drivers](https://agentprime.io/advisories/CVE-2025-4044.md) `CVE-2025-4044` · CVE record: Lexmark Universal Print Driver and 1 more · CVSS 8.2 High · Not analysed yet · Published 19 Aug 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Dell CloudLink](https://agentprime.io/advisories/CVE-2025-26484.md) `CVE-2025-26484` · CVE record: Dell CloudLink · CVSS 5.5 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Siemens SIMOTION SCOUT TIA V5.4 and others](https://agentprime.io/advisories/CVE-2025-40584.md) `CVE-2025-40584` · CVE record: Siemens SIMOTION SCOUT TIA V5.4 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: XML external entities (XXE) - [OpenKilda XXE in SAML configuration](https://agentprime.io/advisories/CVE-2025-54992.md) `CVE-2025-54992` · CVE record: telstra open-kilda · CVSS 6.9 Medium · Not analysed yet · Published 11 Aug 2025 · Tags: XML external entities (XXE) - [XXE leading to SSRF](https://agentprime.io/advisories/CVE-2025-8355.md) `CVE-2025-8355` · CVE record: Xerox FreeFlow Core · CVSS 7.5 High · Not analysed yet · Published 8 Aug 2025 · Tags: XML external entities (XXE) - [Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-54254.md) `CVE-2025-54254` · CVE record: Adobe Adobe Experience Manager · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 5 Aug 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Dell SmartFabric OS10 Software](https://agentprime.io/advisories/CVE-2025-36608.md) `CVE-2025-36608` · CVE record: Dell SmartFabric OS10 Software · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: XML external entities (XXE) - [SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability](https://agentprime.io/advisories/CVE-2025-26400.md) `CVE-2025-26400` · CVE record: SolarWinds Web Help Desk · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Samsung Electronics MagicINFO 9 Server](https://agentprime.io/advisories/CVE-2025-54445.md) `CVE-2025-54445` · CVE record: Samsung Electronics MagicINFO 9 Server · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 23 Jul 2025 · Tags: XML external entities (XXE) - [Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-7766.md) `CVE-2025-7766` · CVE record: Lantronix Provisioning Manager · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2025 · Tags: XML external entities (XXE) - [ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler](https://agentprime.io/advisories/CVE-2025-34142.md) `CVE-2025-34142` · CVE record: ETQ Reliance CG (legacy) · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Dell AppSync](https://agentprime.io/advisories/CVE-2025-36603.md) `CVE-2025-36603` · CVE record: Dell AppSync · CVSS 4.2 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: XML external entities (XXE) - [Jinher OA XmlHttp.aspx xml external entity reference](https://agentprime.io/advisories/CVE-2025-7824.md) `CVE-2025-7824` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2025 · Tags: XML external entities (XXE), CWE-610 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .