Advisories · Weakness

XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-81816 CVE record

Apache OFBiz: XML external entity injection (XXE)
- Apache Software Foundation Apache OFBiz
- XML external entities (XXE)
Not analysed yet 5 Nov 2026
CVE-2026-123029 CVE record

CVSS 7.5 High

XML external entity injection in Wowza Streaming Engine
- Wowza Streaming Engine
- XML external entities (XXE)
Not analysed yet 5 Nov 2026
CVE-2026-13271 CVE record

CVSS 8.1 High

IBM MQ Managed File Transfer is affected by a denial of service vulnerability
- IBM MQ
- XML external entities (XXE)
Not analysed yet 4 Nov 2026
CVE-2026-13284 CVE record

CVSS 7.1 High

IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 4 Nov 2026
CVE-2026-13289 CVE record

CVSS 7.1 High

IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 4 Nov 2026
CVE-2026-19721 CVE record

CVSS 3.3 Low

XXE in TÜBİTAK BİLGEM's İmzager
- TÜBİTAK BİLGEM Software Technologies Research Institute İmzager
- XML external entities (XXE)
Not analysed yet 4 Nov 2026
CVE-2026-92198 CVE record

CVSS 8.2 High

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
- Quest Foglight for Databases
- XML external entities (XXE)
Not analysed yet 3 Nov 2026
CVE-2026-92185 CVE record

CVSS 7.2 High

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability
- Quest Foglight for Databases
- XML external entities (XXE)
Not analysed yet 3 Nov 2026
CVE-2026-114552 CVE record

CVSS 6.5 Medium

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
- MailEnable
- XML external entities (XXE)
Not analysed yet 3 Nov 2026
CVE-2026-93570 CVE record

CVSS 8.2 High

XML External Entity injection in Szafir and Szafir Weryfikująca
- Krajowa Izba Rozliczeniowa Szafir
- Krajowa Izba Rozliczeniowa Szafir Weryfikująca
- XML external entities (XXE)
Not analysed yet 29 Oct 2026
CVE-2026-66090 CVE record

CVSS 7.1 High

XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
- Apereo Foundation openEQUELLA
- XML external entities (XXE)
Not analysed yet 29 Oct 2026
CVE-2026-66089 CVE record

CVSS 6.1 Medium

XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
- Apereo Foundation openEQUELLA
- XML external entities (XXE)
Not analysed yet 29 Oct 2026
CVE-2026-118039 CVE record

CVSS 7.5 High

XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
- Progress Software Telerik Document Processing Libraries
- XML external entities (XXE)
Not analysed yet 28 Oct 2026
CVE-2026-112198 CVE record

CVSS 8.3 High

Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
- Tactis NoviGest Desktop App
- XML external entities (XXE)
Not analysed yet 28 Oct 2026
phpoffice/phpspreadsheet Packagist

CVSS 8.8 High

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
- XML external entities (XXE)
- Denial of service
<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0

GHSA-3x94-m842-937c · CVE-2026-108358 Not analysed yet 27 Oct 2026
phpoffice/phpspreadsheet Packagist

CVSS 8.8 High

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
- XML external entities (XXE)
- Denial of service
>=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 3.10.8, 5.10.0

GHSA-rxj4-h86g-25gc · CVE-2026-108357 Not analysed yet 27 Oct 2026
CVE-2026-90885 CVE record

CVSS 7.5 High

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entit…
- Apache Software Foundation Apache Camel
- XML external entities (XXE)
Not analysed yet 26 Oct 2026
CVE-2026-54668 CVE record

CVSS 8.7 High

Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)
- kitodo-production
- XML external entities (XXE)
Not analysed yet 23 Oct 2026
CVE-2026-113582 CVE record

CVSS 8.7 High

Apache Abdera: XML external entity expansion in Atom document parsing
- Apache Software Foundation Apache Abdera
- XML external entities (XXE)
Not analysed yet 22 Oct 2026
CVE-2026-97400 CVE record

CVSS 6.8 Medium

jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
- Eclipse Foundation Eclipse OpenJ9
- XML external entities (XXE)
- CWE-618
Not analysed yet 20 Oct 2026
CVE-2026-91858 CVE record

CVSS 6.5 Medium

Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
- Apache Software Foundation Apache Camel
- XML external entities (XXE)
Not analysed yet 19 Oct 2026
CVE-2026-88901 CVE record

CVSS 8.2 High

Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
- Apache Software Foundation Apache Camel
- XML external entities (XXE)
Not analysed yet 19 Oct 2026
CVE-2026-85250 CVE record

CVSS 7.5 High

Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
- Apache Software Foundation Apache Camel
- XML external entities (XXE)
Not analysed yet 19 Oct 2026
CVE-2026-104679 CVE record

CVSS 6.9 Medium

XML external entity injection in Yamaha Corporation VOCALOID6 Editor
- Yamaha Corporation VOCALOID6 Editor
- XML external entities (XXE)
Not analysed yet 19 Oct 2026
CVE-2026-88794 CVE record

CVSS 8.2 High

XML External Entity injection in Sparx Enterprise Architect
- Sparx Systems Enterprise Architect
- XML external entities (XXE)
Not analysed yet 15 Oct 2026
CVE-2026-109430 CVE record

CVSS 8.7 High

Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
- Ellucian WebAdvisor
- XML external entities (XXE)
Not analysed yet 15 Oct 2026
CVE-2026-106616 CVE record

CVSS 8.6 High

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- XML external entities (XXE)
Not analysed yet 13 Oct 2026
CVE-2026-90531 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- XML external entities (XXE)
Not analysed yet 13 Oct 2026
CVE-2026-77090 CVE record

CVSS 8.7 High

CVFS Information Disclosure
- Commvault Cloud
- Commvault Grid(HSX) CVFS
- XML external entities (XXE)
Not analysed yet 13 Oct 2026
CVE-2026-93891 CVE record

CVSS 7.6 High

Security Vulnerability identified in IBM TRIRIGA - XXE
- IBM TRIRIGA Application Platform
- XML external entities (XXE)
Not analysed yet 12 Oct 2026
CVE-2026-85970 CVE record

CVSS 7.1 High

Improper XML external entity restriction in Progress MarkLogic Server
- Progress Software Corporation MarkLogic Server
- XML external entities (XXE)
Not analysed yet 12 Oct 2026
CVE-2026-85957 CVE record

CVSS 7.5 High

Improper XML external entity restriction in Progress MarkLogic Server SAML processing
- Progress Software Corporation MarkLogic Server
- XML external entities (XXE)
Not analysed yet 12 Oct 2026
CVE-2026-92877 CVE record

CVSS 8.3 High

XML external entity injection in Eclipse Foundation jaxb-ri (core)
- Eclipse Foundation jaxb-ri (core)
- XML external entities (XXE)
Not analysed yet 12 Oct 2026
CVE-2026-14905 CVE record

CVSS 8.2 High

IBM DataPower Gateway XXE
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- XML external entities (XXE)
Not analysed yet 8 Oct 2026
CVE-2026-102155 CVE record

CVSS 7.1 High

Security Advisory 0190
- Arista Networks CloudVision CUE
- XML external entities (XXE)
Not analysed yet 6 Oct 2026
CVE-2026-101893 CVE record

CVSS 5.1 Medium

Newell Brands DYMO ID document parsing failing file type extension authentication check
- Newell Brands DYMO ID
- XML external entities (XXE)
Not analysed yet 5 Oct 2026
eu.copernik:copernik-xml-factory Maven

CVSS 8.2 High

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
- XML external entities (XXE)
<0.1.2 · fixed in 0.1.2

GHSA-xm28-xvqc-gxxg · CVE-2026-61586 Not analysed yet 2 Oct 2026
CVE-2026-88789 CVE record

CVSS 8.6 High

Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
- Apache Software Foundation Apache Camel Quarkus
- XML external entities (XXE)
Not analysed yet 1 Oct 2026
CVE-2026-102127 CVE record

CVSS 7.0 High

Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
- Kiteworks Email Protection Gateway
- XML external entities (XXE)
Not analysed yet 30 Sept 2026
CVE-2026-82376 CVE record

CVSS 7.7 High

Apache Roller: XML external entity processing in trackback response parser
- Apache Software Foundation Apache Roller
- XML external entities (XXE)
Not analysed yet 28 Sept 2026
CVE-2026-82386 CVE record

CVSS 7.7 High

Apache Roller: XML external entity processing in OPML bookmark import
- Apache Software Foundation Apache Roller
- XML external entities (XXE)
Not analysed yet 28 Sept 2026
CVE-2026-93030 CVE record

CVSS 6.5 Medium

XML external entity injection in IBM Financial Transaction Manager (FTM) for Redhat OpenShift
- IBM Financial Transaction Manager (FTM) for Redhat OpenShift
- XML external entities (XXE)
Not analysed yet 25 Sept 2026
org.http4s:http4s-scala-xml_2.12 +2 Maven

CVSS 9.3 CriticalCritical · CVSS 9+

http4s-scala-xml has an XML External Entity (XXE) processing issue
- XML external entities (XXE)
<0.24.1 · fixed in 0.24.1

GHSA-cjx3-73hr-rpw7 · CVE-2026-61741 Not analysed yet 24 Sept 2026
CVE-2026-81536 CVE record

CVSS 7.7 High

DataStage on Cloud Pak for Data has several vulnerabilities
- IBM DataStage on Cloud Pak for Data
- XML external entities (XXE)
Not analysed yet 23 Sept 2026
CVE-2026-18184 CVE record

CVSS 7.4 High

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- XML external entities (XXE)
Not analysed yet 23 Sept 2026
CVE-2026-18172 CVE record

CVSS 7.4 High

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- XML external entities (XXE)
Not analysed yet 22 Sept 2026
CVE-2026-17646 CVE record

CVSS 8.5 High

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- XML external entities (XXE)
Not analysed yet 22 Sept 2026
net.sf.mpxj:mpxj +6 Maven

CVSS 7.5 High

MPXJ: XXE Vulnerability in MerlinReader
- XML external entities (XXE)
>=5.5.5, <16.4.1 · fixed in 16.4.1

GHSA-5vvx-3h34-f3gj · CVE-2026-61570 Not analysed yet 22 Sept 2026
CVE-2026-94108 CVE record

CVSS 8.3 High

getID3 through 1.9.26 XML External Entity Injection via XML2array
- james-heinrich getid3
- XML external entities (XXE)
Not analysed yet 20 Sept 2026
CVE-2026-76427 CVE record

CVSS 4.9 Medium

Cisco ISE XML External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- XML external entities (XXE)
Not analysed yet 16 Sept 2026
CVE-2026-76446 CVE record

CVSS 4.9 Medium

Cisco Identity Services Engine External Entity Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- XML external entities (XXE)
Not analysed yet 16 Sept 2026
CVE-2026-12666 CVE record

CVSS 8.1 High

IBM MQ Java messaging is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 15 Sept 2026
CVE-2026-12667 CVE record

CVSS 7.1 High

IBM MQ .NET client is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 15 Sept 2026
CVE-2026-12752 CVE record

CVSS 7.1 High

Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026
- IBM Business Automation Workflow containers and traditional
- XML external entities (XXE)
Not analysed yet 15 Sept 2026
CVE-2026-91197 CVE record

CVSS 7.1 High

Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
- flowable-engine
- XML external entities (XXE)
Not analysed yet 14 Sept 2026
CVE-2026-12756 CVE record

CVSS 7.1 High

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
- IBM Business Automation Workflow containers and traditional
- XML external entities (XXE)
Not analysed yet 14 Sept 2026
CVE-2026-13265 CVE record

CVSS 6.8 Medium

IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 14 Sept 2026
CVE-2026-13275 CVE record

CVSS 7.1 High

IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 14 Sept 2026
CVE-2026-13285 CVE record

CVSS 7.1 High

IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 14 Sept 2026
CVE-2026-13287 CVE record

CVSS 7.1 High

IBM MQ Managed File Transfer is vulnerable to XML external entity injection
- IBM MQ
- XML external entities (XXE)
Not analysed yet 14 Sept 2026