Directory Traversal

Mammoth is vulnerable to Directory Traversal. The vulnerability is due to the lack of path or file type validation when processing DOCX files with externally linked images, which allows an attacker to read arbitrary files on the system or trigger excessive resource consumption by referencing...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

XML External Entity (XXE) Injection

Jenkins Semantic Versioning Plugin is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper validation of controller/agent messages and unrestricted parsing of attacker-controlled files containing external entities, allowing attackers controlling agent processes to...

XML External Entity (XXE)

org.jenkins-ci.plugins, jdepend is vulnerable to XML External Entity XXE. The vulnerability is due to improper configuration of the XML parser that does not disable external entity processing, which allows an attacker to exploit crafted XML input to access sensitive information or perform...

XML External Entity (XXE) Injection

org.wso2.am:am-distribution-parent are vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper configuration of the XML parser without sufficient restrictions, which allows an attacker to supply malicious XML to read sensitive files or trigger denial-of-service...

XML External Entity (XXE)

GeoServer is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML entity resolution in schema parsing, which allows an attacker to exploit external entity references to access sensitive data or perform unauthorized actions...

XML External Entity (XXE) Injection

Jenkins TestComplete support Plugin is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the XML parser not being securely configured to disable external entity processing, allowing attackers to supply crafted XML that can access local files or trigger external network...

XML External Entity (XXE)

org.wso2.carbon.mediation, org.wso2.carbon.localentry is vulnerable to XML External Entity XXE. The vulnerability is due to improper XML parser configuration without sufficient restrictions on external entity resolution, which allows an unauthenticated remote attacker to read sensitive files or...

XML External Entity (XXE)

org.jenkins-ci.plugins, generic-webhook-trigger is vulnerable to XML External Entity XXE. The vulnerability is due to improper XML parser configuration that does not disable external entity processing, which allows an attacker to exploit crafted XML input to access sensitive information or perfor...

XML External Entity (XXE) Injection

cyclonedx-core-java is vulnerable to XML External Entity XXE injection. The vulnerability is due to an insecurely configured XML Validator, where external entity processing was not fully disabled during XML validation, allowing attackers to supply a crafted CycloneDX XML BOM that triggers externa...

Open Redirect

Liferay Portal is vulnerable to Open Redirect. The vulnerability is due to improper validation of the comliferaylayoutadminwebportletGroupPagesPortletredirect parameter in the page administration module, which allows an attacker to redirect users to arbitrary external URLs...

CVE-2025-40345

creationtimestamp| type| source ---|---|--- 2025-12-12 19:54:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7sukqmxzn2q 2026-01-21 22:46:10+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mcxqsbv2c225 2026-03-19 00:00:00+00:00| seen|...

CVE-2025-14572

creationtimestamp| type| source ---|---|--- 2025-12-12 19:46:05+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115708314532060478 2025-12-12 21:28:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7szsvwqbh2q 2026-01-12 21:03:47+00:00| published-proof-of-concept|...

Exploit for Improper Restriction of XML External Entity Reference in Geoserver

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML Ext...

CVE-2025-12783

creationtimestamp| type| source ---|---|--- 2025-12-12 08:26:03+00:00| seen| https://gist.github.com/Darkcrai86/36b2c37ade7d6cf2eaa2fa124cb9ac82...

CVE-2025-13891

creationtimestamp| type| source ---|---|--- 2025-12-12 08:09:14+00:00| seen| https://gist.github.com/Darkcrai86/116b7adf4b8afdb09631e0241d603a1e...

XXE (XML External Entity Injection) org.apache.tika:tika-core Dependency in Crowd Data Center and Server

This is a vulnerability in a non-Atlassian Crowd dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity XXE XML External Entity Injection vulnerability was introduced in versions 6.3.0, 6.3.1, 6.3.2, 7.1.0, and 7.1.1 of Crowd Data...

XXE (XML External Entity Injection) org.apache.tika:tika-core Dependency in Bamboo Data Center and Server

This High severity XXE XML External Entity Injection vulnerability was introduced in versions 9.6.1, 10.0.0, 10.1.0, 10.2.0, 11.0.0, and 12.0.0-rc3 of Bamboo Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 8.4 and a CVSS Vector of...

CVE-2025-66516: Detecting and Defending Against Apache Tika XXE Attack

...

Malicious code in iraza2-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a7307c50f4f14642add677ac343109c8691dc3c5e67a0de88d27ed958e9593b The package iraza2-fca was found to contain malicious code. Source: ghsa-malware 5f0c32bd90ff347b69dae6471a8099e36ac566490bfa361193fc59f1c53785d4 Any...