Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
- IBM Business Automation Workflow containers and traditional
- XML external entities (XXE)
- CVSS 7.7 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- XML external entities (XXE)
- CVSS 6.0 Medium
Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
- AWS Advanced JDBC Wrapper
- XML external entities (XXE)
- CVSS 8.7 High
MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
- moxi624 MoguBlog
- XML external entities (XXE)
- CVSS 8.7 High
NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
- NextGen Healthcare Mirth Connect
- XML external entities (XXE)
- CVSS 8.8 High
NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
- NextGen Healthcare Mirth Connect
- XML external entities (XXE)
- CVSS 9.2 CriticalCritical · CVSS 9+
XML External Entity in Akana API Platform
- Perforce Akana
- XML external entities (XXE)
- CVSS 6.9 Medium
Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read
- TP-Link Systems Inc. Omada Software Controller (Windows)
- TP-Link Systems Inc. Omada Software Controller (Linux)
- XML external entities (XXE)
- CVSS 5.9 Medium
OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
- The OpenNMS Group Meridian
- The OpenNMS Group Horizon
- XML external entities (XXE)
- CVSS 5.3 Medium
XML External Entity (XXE) Injection in CyberELF NanoXML
- CyberELF NanoXML
- XML external entities (XXE)
- CVSS 7.4 High
XXE Vulnerability in Cosminexus Component Container
- Hitachi Cosminexus Component Container
- XML external entities (XXE)
- CVSS 8.5 High
XML External Entity (XXE) Vulnerability in SAP Integration Suite
- SAP_SE SAP Integration Suite
- XML external entities (XXE)
- CVSS 7.5 High
An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via su…
- XML external entities (XXE)
- CVSS 5.3 Medium
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- IBM App Connect Enterprise
- IBM Integration Bus for z/OS
- XML external entities (XXE)
- CVSS 5.3 Medium
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- IBM App Connect Enterprise
- IBM Integration Bus for z/OS
- XML external entities (XXE)
- CVSS 7.7 High
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- IBM App Connect Enterprise
- IBM Integration Bus for z/OS
- XML external entities (XXE)
- CVSS 6.8 Medium
Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
- Exterro FTK Imager
- XML external entities (XXE)
- CWE-829
- CVSS 6.7 Medium
XML external entity injection in Keyence Corporation XG-X VisionTerminal and others
- Keyence Corporation XG-X VisionTerminal
- Keyence Corporation XG VisionTerminal
- XML external entities (XXE)
- CVSS 7.5 High
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
- Red Hat Build of Apache Camel 3.33.3.SP1
- Red Hat build of Keycloak 26.6
- XML external entities (XXE)
- CVSS 8.7 High
YaCy Search Server through 1.941 XML External Entity Injection via Parsers
- yacy_search_server
- XML external entities (XXE)
- CVSS 8.6 High
MapFish Print has XXE that allows reading arbitrary files of certain types
- XML external entities (XXE)
>=3.0.0, <3.28.30 || >=3.29.0, <3.30.32 || >=3.32.0, <3.33.16 || >=3.34.0, <4.0.5 · fixed in 3.28.30, 3.30.32, 3.33.16, 4.0.5
GHSA-5v29-34h8-v68r · CVE-2026-55848 - CVSS 5.1 Medium
pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference
- pkp-lib
- XML external entities (XXE)
- CWE-610
- CVSS 7.5 High
XML external entity injection in Cisco BroadWorks
- Cisco BroadWorks
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Dell Command Update (DCU)
- Dell Command Update (DCU)
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Dell OpenManage Enterprise
- Dell OpenManage Enterprise
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in JetBrains IntelliJ IDEA
- JetBrains IntelliJ IDEA
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in JetBrains IntelliJ IDEA
- JetBrains IntelliJ IDEA
- XML external entities (XXE)
- CVSS 8.3 High
Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
- datavane tis
- XML external entities (XXE)
- CVSS 6.5 Medium
IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
- i
- XML external entities (XXE)
- CVSS 8.7 High
XML external entity injection in Eclipse Foundation Eclipse RDF4J
- Eclipse Foundation Eclipse RDF4J
- XML external entities (XXE)
- CVSS 6.3 Medium
XXE in Ministry of Justice's UYAP Document Editor
- Ministry of Justice UYAP Document Editor
- XML external entities (XXE)
- CVSS 6.1 Medium
FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser
- FreeCAD
- XML external entities (XXE)
- CVSS 6.5 Medium
XML External Entity Injection in SAP BusinessObjects Business Intelligence
- SAP_SE SAP BusinessObjects Business Intelligence
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · CVSS 9+
JasperReports Server: XXE Injection Vulnerability (Unauthenticated)
- Jaspersoft JasperReports Server
- XML external entities (XXE)
- CVSS 7.5 High
Apache CXF: XXE via WSDL/XSD import parsing
- Apache Software Foundation Apache CXF
- XML external entities (XXE)
- CVSS 7.1 High
XML external entity injection in Jenkins Project Jenkins Ivy Report Plugin
- Jenkins Project Jenkins Ivy Report Plugin
- XML external entities (XXE)
- CVSS 8.2 High
IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
- IBM QRadar
- XML external entities (XXE)
- CVSS 4.6 Medium
XML external entity injection in Eclipse Foundation Eclipse Accessibility Tools Framework (ACTF)
- Eclipse Foundation Eclipse Accessibility Tools Framework (ACTF)
- XML external entities (XXE)
- CVSS 5.5 Medium
IBM DataPower Gateway affected by XML external entity injection
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.5.0
- XML external entities (XXE)
- CVSS 8.7 High
CentreStack < 17.4 XXE via SharePoint Storage Configuration
- Gladinet CentreStack
- XML external entities (XXE)
- CVSS 6.5 Medium
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
- XML external entities (XXE)
>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71
GHSA-cg9x-g3gm-h5h6 · CVE-2026-54082 - CVSS 8.7 High
veraPDF Validation XXE via Rich Text
- XML external entities (XXE)
>=1.25.73, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71
GHSA-3jh7-wm29-q568 · CVE-2026-54078 - CVSS 8.7 High
veraPDF Validation XXE via XFA
- XML external entities (XXE)
>=1.17.35, <1.30.2 || >=1.31.1, <1.31.71 · fixed in 1.30.2, 1.31.71
GHSA-36mm-w85j-3q2j · CVE-2026-54079 - CVSS 7.5 High
Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint.
- XML external entities (XXE)
- CVSS 4.8 Medium
Improper Restriction of XML External Entity Reference in proCertum SmartSign
- Asseco proCertum SmartSign
- XML external entities (XXE)
- CVSS 8.3 High
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
- XML external entities (XXE)
>=4.2.0.Final, <4.2.16.Final || >=4.1.0.Final, <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-4qhr-g3c6-fcfx · CVE-2026-56817 - CVSS 7.5 High
XXE in Netcad's NetGIS
- Netcad Software Inc. NetGIS
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.
- XML external entities (XXE)
- CVSS 9.6 CriticalCritical · CVSS 9+
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- XML external entities (XXE)
- CVSS 5.3 Medium
XML external entity injection in Dell Unisphere for PowerMax
- Dell Unisphere for PowerMax
- XML external entities (XXE)
- CVSS 6.5 Medium
Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read
- Foxit Software Inc. Foxit PDF Editor
- Foxit Software Inc. Foxit PDF Reader
- XML external entities (XXE)
- CVSS 7.6 High
OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
- XML external entities (XXE)
<1.24.2 · fixed in 1.24.2
GHSA-7v6w-c3f4-9wpq · CVE-2026-54640 - CVSS 4.0 Medium
Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
- Apache Software Foundation Apache Lucene.Net
- XML external entities (XXE)
- CVSS 7.6 High
XXE attack in IBM Business Automation Manager Open Editions
- IBM Business Automation Manager Open Editions
- XML external entities (XXE)
- CVSS 6.3 Medium
weixin-python XML External Entity vulnerability
- XML external entities (XXE)
<0.5.5 · fixed in 0.5.5
GHSA-h384-ph77-3699 · CVE-2018-25082 - CVSS 8.5 High
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
- XML external entities (XXE)
>=3.3.0, <3.3.1 || <3.2.6 · fixed in 3.3.1, 3.2.6
GHSA-7g64-f2hm-vjxp · CVE-2026-12975 - CVSS 6.5 Medium
Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload
- XML external entities (XXE)
<2.0.0-beta.2 · fixed in 2.0.0-beta.2
GHSA-32fw-h446-j4hh - CVSS 7.0 High
libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
- GNOME libxml2
- Memory corruption
- XML external entities (XXE)
- CVSS 5.3 Medium
zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference
- zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台
- XML external entities (XXE)
- CWE-610
- CVSS 2.6 Low
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
- XML external entities (XXE)
- CWE-178
<1.19.4 · fixed in 1.19.4
GHSA-8678-w3jw-xfc2 · CVE-2026-57234