veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Summary veraPDF-validation has an XML External Entity XXE vulnerability in two PDF parsing paths validate and GFPDAcroForm.getdynamicRender. A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values o...

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

EUVD-2026-50370

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

CVE-2026-54082

The CVE-2026-54082 entry affects veraPDF-validation, specifically the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() paths. The issue stems from parsing using the default DocumentBuilderFactory, enabling XML External Entity (XXE) processing when handling rich-text annotations, fo...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

CVE-2026-54078 veraPDF Validation XXE via Rich Text

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

GHSA-36MM-W85J-3Q2J veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

EUVD-2026-50368

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

CVE-2026-50782

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2026-50782

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2026-57917

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity XXE vulnerability is triggered simply by previewing a file in the file...

CVE-2026-57917

CVE-2026-57917 affects proCertum SmartSign. The issue is an XML External Entity (XXE) vulnerability where external entities are parsed from crafted signature files, enabling SSRF and potentially local file reads depending on parser configuration. The vulnerability is triggered by previewing a fil...

EUVD-2026-49143

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity XXE vulnerability is triggered simply by previewing a file in the file...

CVE-2026-57917

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity XXE vulnerability is triggered simply by previewing a file in the file...

Linux Distros Unpatched Vulnerability : CVE-2026-56817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

HPESBNW05085 rev.1 - HPE Unified Correlation Analyzer (UCA), Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity, XML External Entity XXE; Remote: Compromise of System Integrity, XML External Entity XXE SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Correlation Analyzer UCA All versions prior to 4.4.11 CVSS Scores:...

CVE-2026-14865

In Progress Telerik UI for AJAX (older than v2026.2.708), the internal LayoutBuilder processes client-state XML without disabling DTD processing, enabling unauthenticated denial of service via recursive XML entity expansion. The vulnerability affects the UI component handling client-state XML; af...