CVE-2025-64518

An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...

CVE-2025-64518

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML Validator used by cyclonedx-core-java was not configured securely, making the library...

Malicious code in node-earth-static-reject-xml (npm)

The package node-earth-static-reject-xml was found to contain malicious code...

MAL-2025-27615 Malicious code in node-earth-static-reject-xml (npm)

The package node-earth-static-reject-xml was found to contain malicious code...