PT-2026-8258

CVE-2025-35976 - Apache Struts XML External Entity XXE Injection CVE ID : CVE-2025-35976 Published : Feb. 13, 2026, 7:16 p.m. | 18 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused Severity: 0.0 | NA Visit the...

CVE-2026-1227

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

CLSA-2026-1770899757 Fix CVE(s): CVE-2026-24515

SECURITY UPDATE: XMLExternalEntityParserCreate failure to copy the encoding handler data can cause a NULL dereference CWE-476 from external entities that declare use of an unknown encoding. The expected impact is denial of service. - debian/patches/CVE-2026-24515.patch: Make...

CVE-2020-37192

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...

CVE-2020-37192

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...

CVE-2020-37192

MSN Password Recovery 1.30 is affected by an XML External Entity (XXE) vulnerability that allows a local attacker to read local system files by supplying crafted XML input. The attack targets the Favorites tab via XML references to external entities, exposing sensitive configuration information. ...

CVE-2020-37192 MSN Password Recovery 1.30 - XML External Entity Injection

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...

CVE-2020-37192 MSN Password Recovery 1.30 - XML External Entity Injection

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...

CVE-2026-1227

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

CVE-2026-1227

CVE-2026-1227 describes an XML External Entity (XXE) vulnerability (CWE-611) in which a local user uploading a specially crafted TGML graphics file to the EBO server from Workstation could trigger unauthorized disclosure of local files, unintended interaction within the EBO system, or denial of s...

CVE-2026-1227

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

CVE-2026-1227

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

CVE-2026-1227

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

MAL-2026-854 Malicious code in sinon-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9ac1d9ff3647908703db921b2e950e479861f18e7b1bad8377baaa7400d32c The package sinon-node was found to contain malicious code. Source: ghsa-malware 5aa93130bd1915120b30dc2472c774ac984ea2c2166d7865d30fdf8343225f50 Any...

USN-8023-1 libxmltok vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled the initialization of parsers for external entities. An attacker could possibly use this issue to cause a denial of service. CVE-2026-24515 It was discovered that Expat, contained within the xmltok library,...

USN-8023-1: xmltok library vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled the initialization of parsers for external entities. An attacker could possibly use this issue to cause a denial of service. CVE-2026-24515 It was discovered that Expat, contained within the xmltok library,...

PT-2026-7582

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from...

PT-2026-7690

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...

Schneider Electric EcoStruxure Building Operation Workstation 代码问题漏洞

Schneider Electric EcoStruxure Building Operation Workstation is a specialized operational terminal component developed by Schneider Electric, a French company. There is a code vulnerability in the Schneider Electric EcoStruxure Building Operation Workstation. This vulnerability stems from improp...

Vulnerability of the ManifestParser and AmazonS3 classes in the Git version control system for the Java Eclipse JGit language, allowing attackers to perform XXE attacks

The vulnerability of the ManifestParser and AmazonS3 classes in the Git version control system, implemented in the Java Eclipse JGit framework, is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attack...