PT-2026-2375

Name of the Vulnerable Software and Affected Versions Geonetwork versions 3.10 through 4.2.0 Description Geonetwork contains a flaw in its PDF rendering process related to XML external entities. This allows attackers to retrieve arbitrary files from the server. The issue stems from an insecure XM...

EUVD-2021-15078

Malware in sbrugna...

EUVD-2025-17815

Malicious code in bioql PyPI...

GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...

CVE-2025-30220

Geoserver-related CVE-2025-30220 is an XXE processing vulnerability in the GeoTools gt-xsd-core handling used by GeoServer WFS. The issue arises when building in‑memory XSD schemas without applying a proper EntityResolver, enabling unauthenticated attackers to exfiltrate local files and trigger S...

CVE-2024-32037

GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software...