CVE-2026-58400

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400

GeoNetwork, an open-source geospatial metadata catalog maintained under OSGeo, is vulnerable to remote code execution via its Saxon XSLT processor used to render formatters. The processor lacks FEATURE_SECURE_PROCESSING and has ALLOW_EXTERNAL_FUNCTIONS enabled, allowing any loaded stylesheet to i...