CVE-2026-18172

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-17646

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18172 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18172 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18172

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a remote attack where an adversary could obtain sensitive information. The root cause is the improper restriction of XML external entity references (CWE-611). Affected versions include 4.0.6.0 through 4.0.10.0 (specific...

CVE-2026-17646

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability involving the improper restriction of XML external entity references . This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific patch versions or exploit details ...

CVE-2026-17646 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-17646 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-17646: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

PT-2026-97035

Name of the Vulnerable Software and Affected Versions MPXJ versions 5.5.5 through 16.4.0 Description When parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, the software creates a DocumentBuilder with default settings that leave doctype declarations and external...

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

PT-2026-95959

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.27 Description An XML external entity injection issue exists in the XML2array helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to...

ROOT-APP-NPM-GHSA-4W3W-2RP5-G8JM GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom - Patched by Root

Root has patched GHSA-4w3w-2rp5-g8jm in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

CVE-2026-76427: Improper Restriction of XML External Entity Reference

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

CVE-2026-76446: Improper Restriction of XML External Entity Reference

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit th...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

EUVD-2026-78206

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...