When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into ...

CVE-2026-40991

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an

历史摘要 · 未重新核验 · NVD

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML...

CVE-2026-47960

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference

历史摘要 · 未重新核验 · GitHub Advisory

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file ...

CVE-2026-47960

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference

历史摘要 · 未重新核验 · NVD

CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a D...

CVE-2026-8045

CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosu

历史摘要 · 未重新核验 · NVD

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

CVE-2026-44018

### Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVE-2026-49383

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

历史摘要 · 未重新核验 · GitHub Advisory

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVE-2026-49383

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

历史摘要 · 未重新核验 · NVD

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

CVE-2026-45071

### Description `symfony/dom-crawler` provides the `Crawler` class for navigating HTML/XML documents with CSS/XPath sel

历史摘要 · 未重新核验 · GitHub Advisory

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving extern...

CVE-2026-2253

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, d

历史摘要 · 未重新核验 · NVD

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 is vulnerable to an XML external...

CVE-2026-3603

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 is vulnerable to an XML external entity injection (XXE) att

历史摘要 · 未重新核验 · GitHub Advisory

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vuln...

CVE-2026-3603

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Int

历史摘要 · 未重新核验 · NVD

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be rea...

CVE-2026-46722

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document place

历史摘要 · 未重新核验 · NVD

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-controlled XML is passed to framework parsing entry points ...

CVE-2026-39053

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. When attacker-co

历史摘要 · 未重新核验 · NVD

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restriction of XML external entity (XXE) reference vulnerability ...

CVE-2026-44445

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, an improper restrict

历史摘要 · 未重新核验 · NVD

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLPars...

CVE-2026-41895

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches

历史摘要 · 未重新核验 · NVD

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the Sol...

CVE-2026-42212

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

历史摘要 · 未重新核验 · NVD

Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.

CVE-2023-42346

Alkacon OpenCms before 16 allows XXE when the refers to an external host.

来源摘录 · NVD

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.

CVE-2023-42344

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/

来源摘录 · NVD

Grav is Vulnerable to XXE via SVG Upload

Dear Grav Security Team, A security vulnerability was discovered in Grav CMS that allows authenticated attackers to rea

历史摘要 · 未重新核验 · GitHub Advisory