CVE-2026-118975

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...

CVE-2026-118975: Progress Software Telerik Reporting: In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references…

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...

CVE-2026-119724

A flaw was found in Apache jclouds. The XML parser does not properly restrict recursive entity references within Document Type Definitions DTDs. By submitting a specially crafted XML document containing recursive entity definitions, a remote attacker could consume excessive memory and CPU...

IBM MQ 9.2 < 9.2.0.46 LTS / 9.3 < 9.3.0.43 LTS / 9.4 < 9.4.0.30 LTS / 9.4 CD < 10.0.1.0 / 10.0 < 10.0.0.6 (7294654)

The version of IBM MQ Server running on the remote host is 9.2.0.0 prior to 9.2.0.46 LTS, or 9.3.0.0 prior to 9.3.0.43 LTS, or 9.4.0.0 prior to 9.4.0.30 LTS, or 9.4.0.0 through 9.4.5.1 CD, or 10.0.0.0 through 10.0.0.5. It is, therefore, affected by a vulnerability as referenced in the 7294654...

CVE-2026-13271

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

CVE-2026-13271 IBM MQ Managed File Transfer is affected by a denial of service vulnerability

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

EUVD-2026-117070

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

CVE-2026-13271

IBM MQ Managed File Transfer is impacted by a high-severity vulnerability (CVE-2026-13271 ) caused by the improper restriction of XML external entity references during command queue processing. This flaw could allow an authenticated attacker to obtain sensitive information or cause a denial of se...

CVE-2026-91858

A flaw was found in camel-fop. When third-party XML processing libraries are present on the classpath, the component fails to properly restrict external resource resolution during document transformations. A remote attacker can exploit this flaw by submitting a crafted document containing externa...

PT-2026-137167

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

CVE-2026-119724: Apache Software Foundation Apache JClouds: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion')…

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...

Security Bulletin: IBM MQ Managed File Transfer is affected by a denial of service vulnerability (CVE-2026-13271)

Summary IBM MQ Managed File Transfer has addressed a denial of service vulnerability due to improper restriction of XML external entity references in command queue processing. Vulnerability Details CVEID:CVE-2026-13271 DESCRIPTION: IBM MQ Managed File Transfer could allow an authenticated attacke...

Progress Software Telerik Document Processing Libraries input validation error vulnerability

Versions of Progress Software Telerik Document Processing Libraries prior to 2026.3.1027 contain an input validation error vulnerability. This vulnerability stems from XML external entity references in SVG image processing, potentially allowing unauthenticated attackers to read local server files...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

EUVD-2026-108166

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

PT-2026-121389

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

Apache Abdera input validation error vulnerability

All versions of Apache Abdera contain an input validation error vulnerability. This vulnerability stems from improper restrictions on XML external entity references. When the application uses Abdera to parse XML controlled by attackers, it may allow attackers to access sensitive data or initiate...

Apache Cocoon resource management error vulnerability

All versions of Apache Cocoon are affected by a resource management error vulnerability. This vulnerability stems from improper restrictions on recursive entity references within DTDs XML entity extensions. XEE in fp: form processor may lead to Server-Side Request Forgery SSRF, potentially exposi...

CVE-2026-85250

A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A remote attacker can exploit this flaw by submitting speciall...