CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

UBUNTU-CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

EUVD-2026-97469

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

CVE-2026-92877

The JAXB factory methods are vulnerable to XML External Entity (XXE) resolution because they historically relied exclusively on the FEATURE_SECURE_PROCESSING flag. On JAXP implementations where this feature does not sufficiently block external entities, an attacker capable of providing untrusted ...

CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

PT-2026-110611

Name of the Vulnerable Software and Affected Versions JAXB affected versions not specified Description JAXB factory methods relied exclusively on FEATURE SECURE PROCESSING to prevent XML External Entity XXE resolution. In JAXP implementations where this feature is insufficient to block external...

CVE-2026-92877: Improper Restriction of XML External Entity Reference

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

org.docx4j:docx4j-diffx (8.1.7), org.docx4j:docx4j-docx-anon (8.1.7) +3 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.7)

org.docx4j:docx4j-core MAVEN version 8.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.7 - org.docx4j:docx4j-docx-anon 8.1.7 - org.docx4j:docx4j-jaxb-internal 8.1.7 -...

org.docx4j:docx4j-diffx (8.2.0), org.docx4j:docx4j-documents4j-local (8.2.0) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.0)

org.docx4j:docx4j-core MAVEN version 8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.0 - org.docx4j:docx4j-documents4j-local 8.2.0 - org.docx4j:docx4j-documents4j-remote...

com.vladsch.flexmark:flexmark-docx-converter (>=0.50.24, <=0.61.10), org.docx4j:docx4j-diffx (8.1.2) +5 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.2)

org.docx4j:docx4j-core MAVEN version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.vladsch.flexmark:flexmark-docx-converter =0.50.24, =0.61.10 - org.docx4j:docx4j-diffx 8.1.2 -...

org.docx4j:docx4j-diffx (8.2.1), org.docx4j:docx4j-documents4j-local (8.2.1) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.1)

org.docx4j:docx4j-core MAVEN version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.1 - org.docx4j:docx4j-documents4j-local 8.2.1 - org.docx4j:docx4j-documents4j-remote...

org.docx4j:docx4j-diffx (8.1.3), org.docx4j:docx4j-docx-anon (8.1.3) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.3)

org.docx4j:docx4j-core MAVEN version 8.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.3 - org.docx4j:docx4j-docx-anon 8.1.3 - org.docx4j:docx4j-export-fo 8.1.3 -...

org.docx4j:docx4j-diffx (8.2.2), org.docx4j:docx4j-documents4j-local (8.2.2) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.2)

org.docx4j:docx4j-core MAVEN version 8.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.2 - org.docx4j:docx4j-documents4j-local 8.2.2 - org.docx4j:docx4j-documents4j-remote...

cn.bctools:jvs-starter-word (1.1.0), org.docx4j:docx4j-diffx (8.1.1) +5 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.1)

org.docx4j:docx4j-core MAVEN version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - cn.bctools:jvs-starter-word 1.1.0 - org.docx4j:docx4j-diffx 8.1.1 - org.docx4j:docx4j-docx-anon 8.1.1 -...

org.docx4j:docx4j-diffx (8.1.0), org.docx4j:docx4j-docx-anon (8.1.0) +4 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.0)

org.docx4j:docx4j-core MAVEN version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.0 - org.docx4j:docx4j-docx-anon 8.1.0 - org.docx4j:docx4j-export-fo 8.1.0 -...

com.browseengine.bobo:bobo-browse (>=3.2.0, <=4.0.2), com.browseengine.bobo:bobo-solr (3.2.0) +435 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.5)

org.springframework:spring-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.browseengine.bobo:bobo-browse =3.2.0, =0.2.0, =0.0.2, =0.1.9, =0.1.3, =0.6.0, =0.7.8, =0.6.0,...

com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.10), com.github.krasa:krasa-jaxb-tools (1.8) +514 more potentially affected by CVE-2026-42402 via org.apache.neethi:neethi (2.0.4)

org.apache.neethi:neethi MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.custardsource.parfait:parfait-cxf =0.2.0, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =4.0.3, =1.0,...

com.custardsource.parfait:parfait-cxf (>=0.2.0, <=0.3.10), com.github.krasa:krasa-jaxb-tools (1.8) +514 more potentially affected by CVE-2026-42403 via org.apache.neethi:neethi (2.0.4)

org.apache.neethi:neethi MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.neethi:neethi and may be impacted: - com.custardsource.parfait:parfait-cxf =0.2.0, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =4.0.3, =1.0,...