ROOT-APP-NPM-GHSA-4W3W-2RP5-G8JM GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom - Patched by Root

Root has patched GHSA-4w3w-2rp5-g8jm in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

CVE-2026-76572 pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...

CVE-2026-20320

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2026-50645 vulnerabilities

Vulnerabilities for packages: wso2is, apache-tika, apache-tika-fips...

CVE-2026-75058

XML External Entity (XXE) injection in IntelliJ IDEA's Eclipse settings importers affects versions before 2026.2.1. CVSS 5.5 (MEDIUM) — local attack, no privileges, high confidentiality impact. Remediation: upgrade to IntelliJ IDEA 2026.2.1 or later. No in-the-wild exploitation reported. Details:...

EUVD-2019-1044

Malware in sbrugna...

EUVD-2020-27999

Malware in sbrugna...

EUVD-2018-0420

Malware in sbrugna...

EUVD-2020-6519

Malware in sbrugna...

EUVD-2015-8722

Malware in sbrugna...

EUVD-2023-0296

Malicious code in bioql PyPI...

CVE-2025-5466: Improper Restriction of Recursive Entity References in DTDs

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges to trigger a denial of...

CVE-2024-34711: Exposure of Sensitive Information to an Unauthorized Actor

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

CVE-2024-10218 TIBCO Hawk Stored-XEE Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

Toshiba Printers Multiple Vulnerabilities (May 2024)

Multiple Toshiba printers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

GHSA-8X2V-PCG7-94F4 Zend-JSON vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

Zend-JSON vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

GHSA-2JX7-XG83-J2M7 Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

ZendFramework potential XML eXternal Entity injection vectors

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...