CVE-2025-64518

CVE-2025-64518 affects CycloneDX core (Java). From 2.1.0 up to but excluding 11.0.1, the XML Validator in cyclonedx-core-java was insecurely configured, enabling XML External Entity (XXE) injection. The issue is tied to incomplete mitigation that fixed parsing but not validation (GHSA-683x-4444-j...

CVE-2025-64518 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML Validator used by cyclonedx-core-java was not configured securely, making the library...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +102 more potentially affected by CVE-2025-64518 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=11.0.0)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =0.4.0, =1.0.0, =1.0.0, =0.9.0, =0.120.0, =0.9.0, =0.105.0, =0.157.0, =0.157.0, =0.137.0, =0.115.0, =0.9.0, =0.125.0 and more Source cves: CVE-2025-64518 Source advisor...

com.cyclonedx:cyclonedx-gradle-plugin (>=1.1.2, <=1.5.0), com.free-now.sauron.plugins:dependency-checker (>=0.0.57, <=0.0.74) +102 more potentially affected by CVE-2025-64518 via org.cyclonedx:cyclonedx-core-java (>=2.1.1, <=11.0.0)

org.cyclonedx:cyclonedx-core-java MAVEN version =2.1.1, =1.1.2, =0.0.57, =1.0.0, =0.4.0, =1.0.0, =1.0.0, =0.9.0, =0.120.0, =0.9.0, =0.105.0, =0.157.0, =0.157.0, =0.137.0, =0.115.0, =0.9.0, =0.125.0 and more Source cves: CVE-2025-64518 Source advisor...

GHSA-6FHJ-VR9J-G45R CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

CycloneDX Core code issue vulnerability

CycloneDX Core is a CycloneDX BOM Standard open source aid for creating SBOM applications. A code issue vulnerability exists in CycloneDX Core versions prior to 11.0.1 that stems from an unsecured configuration of the XML Validator, which could lead to an XML external entity injection attack...

CVE-2025-64518: Improper Restriction of XML External Entity Reference

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML Validator used by cyclonedx-core-java was not configured securely, making the library...

PT-2025-46213

Name of the Vulnerable Software and Affected Versions CycloneDX versions 2.1.0 through 11.0.1 Description The CycloneDX core module, used for creating, validating, and parsing SBOMs, contains a flaw due to an insecurely configured XML Validator. This allows for XML External Entity XXE injection...

EUVD-2025-24571

Malicious code in bioql PyPI...

EUVD-2024-1944

Malicious code in bioql PyPI...

EUVD-2022-29594

Malicious code in bioql PyPI...

EUVD-2024-1382

Malicious code in bioql PyPI...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

PT-2025-32992 · Unknown · Cyclonedx Sunshine

Name of the Vulnerable Software and Affected Versions: CycloneDX Sunshine version 0.9 Description: CycloneDX Sunshine version 0.9 is vulnerable to CSV Formula Injection via a crafted JSON file. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

CVE-2025-52386

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CycloneDX Sunshine security vulnerability

CycloneDX Sunshine is an open source visualization tool from CycloneDX. A security vulnerability exists in CycloneDX Sunshine version v0.9 that stems from processing JSON files without validating formulas, which could lead to a CSV injection attack...

CVE-2025-52386

The open-source visualization tool CycloneDX Sunshine version v0.9 is vulnerable to CSV Formula Injection (CWE-1236). The root cause is the software's failure to validate formulas when processing crafted JSON files . This vulnerability can lead to malicious code execution or data exfiltration whe...