CVE-2026-88789

A flaw was found in Apache Camel Quarkus. The XML transformation support extension configures a transformer that fails to enforce restrictions on external entities and stylesheets. A remote attacker can exploit this vulnerability by submitting a specially crafted XML document during transformatio...

CVE-2026-123029

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

CVE-2026-123029

The Wowza Streaming Engine version before 4.12.2 is vulnerable to an XML external entity (XXE) injection. An unhandled processing of external entities allows remote attackers to read local files with the same privileges as the Wowza Streaming Engine process. No specific exploit links or remediati...

EUVD-2026-117386

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

Safir input validation error vulnerability in the National Accounting Office

The input validation error vulnerability exists in Szafir 2.0.0 and earlier versions, as well as Szafir Weryfikująca 1.0 and earlier versions. This vulnerability stems from the parser’s handling of external entities when processing specially crafted XML files containing external DTD references to...

Tactis NoviGest Desktop App input validation error vulnerability

The Tactis NoviGest Desktop App versions prior to 8.0.0-300 contain an input validation error vulnerability. This vulnerability arises because the SAFT import functionality fails to properly disable external entity resolution when processing XML files controlled by users via JAXB Unmarshaller. As...

Apache Camel input validation error vulnerability

Security vulnerabilities exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These stem from the XQueryBuilder in camel-saxon, which uses the default Saxon Configuration to parse stream-based Source message bodies. No restrictions are placed on DOCTYPE declarations or...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation. This vulnerability arises when the FopProducer creates a TransformerFactory by enabling only FEATURESECUREPROCESSING, without restricting access to external resources...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.7.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper restrictions on external entities by the camel-smooks component. The default XML parser allows for the parsing of external...

IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 10.0.0.5 CD / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS (7284936)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7284936 advisory. - IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 throug...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2022_7470)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227470 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: pki-acme / pki-base / pki-base-java / pki-ca / pki-kra / pki-server / etc (crlsa-2022_7326)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227326 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Expat vulnerabilities (USN-8813-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8813-1 advisory. It was discovered that Expat did not correctly handle certain integer arithmetic...

USN-8813-1 expat vulnerabilities

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411 It was discovered that Expat did not correctly track handler cal...

CVE-2026-61570

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

EUVD-2026-84820

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

CLEANSTART-2026-DL82237 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities

Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8, various XML functions rely on the libxml global state to track configuration variables, such as whether external entities are loaded. This state is assumed to remain unchanged unless the user explicitly changes it by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002402)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002402 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, lik...