CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

N-central - XML External Entities Injection

N-central versions %xxe; rand http: - raw: - | POST /dms/services/ServerUI HTTP/2 Host: Hostname Content-Type: text/xml Soapaction: "" soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope...

CVE-2026-71375

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2026-71375

Cosminexus Component Container by Hitachi is affected by an XML external entity (XXE) injection flaw, caused by improper restriction of XML external entity references. The vulnerability spans a wide range of versions from 09-00 through 09-00-18 up to 11-70-01 (each with specific fixed versions, e...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

EUVD-2026-72655

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CLEANSTART-2026-BC74118 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the external-secrets-operator package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See...

EUVD-2026-72578

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958

SAP Integration Suite contains an XML External Entity (XXE) vulnerability in certain internal components that do not sufficiently validate XML documents accepted from untrusted sources. An attacker with low privileges can submit crafted XML payloads containing malicious external entity declaratio...

CVE-2026-69805: External Control of File Name or Path

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

PT-2026-86999

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

PT-2026-87110

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-78620: External Control of File Name or Path

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-62804: External Control of File Name or Path

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

PT-2026-87024

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

PT-2026-87136

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-69355: External Control of File Name or Path

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

CVE-2026-71375: Improper Restriction of XML External Entity Reference

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...