Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
43 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.3
CVE-2026-112181

Multiple Vulnerabilities in OpenKM Community Edition

Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

OpenKM · OpenKM Community Edition
medium6.5
CVE-2026-118975

XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Progress Software · Telerik Reporting
medium5.5
CVE-2026-91876

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML…

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · OpenManage Ansible Modules
high7.7
CVE-2026-105153

Apache Roller: XML external entity processing in AtomPub entry parsing

Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Roller
critical9.9
CVE-2026-121887

Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Adobe · Adobe Connect / Adobe · Adobe Connect
high7.7
CVE-2026-121890

Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Adobe · Adobe Connect / Adobe · Adobe Connect
critical9.3
CVE-2026-125883

Multiple XXE Vulnerabilities

Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

N-able · N-central
low3.7
CVE-2026-126062Package fixes recorded

JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host

On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.

Recorded fixes — nokogiri: 1.19.5. Check your release branch.

Exploitation not established

RubyGems / nokogiri
medium6.1
CVE-2026-122985

Microsoft PowerShell Information Disclosure Vulnerability

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · PowerShell 7.6 / Microsoft · PowerShell 7.7
medium6.5
CVE-2026-122196

Microsoft Dynamics 365 (on-premises) Information Disclosure Vulnerability

Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft Power Apps
critical9.1
CVE-2026-109798

XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

SAP_SE · SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
high7.2
CVE-2026-118468

AIS XML parsers allow external entity resolution

XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CompuGroup Medical · Infantia / CompuGroup Medical · Profim
critical9.1
CVE-2026-120761

Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Axis2/Java
medium5.0
CVE-2026-80435

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · DataStage on Cloud Pak for Data
high8.2
CVE-2026-17323

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
critical9.9
CVE-2026-16884

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium6.3
CVE-2026-123824

Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. A remote attacker who can supply XML to this method can determine whether local files exist, cause a denial of service, and, in some configurations, exfiltrate local file content via a crafted XML document whose doctype declares an external file:// entity. XmlUtils::parse() sets $dom->validateOnParse = true before calling loadXML() and only rejects documents carrying a doctype afterwards. Enabling DTD validation makes libxml resolve external entities during loadXML(), and LIBXML_NONET blocks http:// but not file://, so a file:// entity is read from disk before the doctype rejection runs. The content of the file is not returned to the caller, but the distinct libxml error for a missing path reveals whether a file exists, and an entity pointing at a large or slow file causes a denial of service. If the application registers a network-capable stream wrapper such as s3://, a parameter entity can also send the content of a local file to an external server. This is the same issue as CVE-2026-45071, which was fixed in the DomCrawler component but not in Config.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sensiolabs · symfony
low3.5
CVE-2026-81816

Apache OFBiz: XML external entity injection (XXE)

XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache OFBiz
high7.5
CVE-2026-123029

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza…

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Wowza · Streaming Engine
high8.1
CVE-2026-13271

IBM MQ Managed File Transfer is affected by a denial of service vulnerability

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · MQ
high7.1
CVE-2026-13284

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · MQ
high7.1
CVE-2026-13289

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · MQ
low3.3
CVE-2026-19721

XXE in TÜBİTAK BİLGEM's İmzager

Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

TÜBİTAK BİLGEM Software Technologies Research Institute · İmzager
high8.2
CVE-2026-92198

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Quest · Foglight for Databases
high7.2
CVE-2026-92185

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Quest · Foglight for Databases
medium6.5
CVE-2026-114552

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

MailEnable · MailEnable
high8.2
CVE-2026-61586

Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). An application parsing untrusted XML can resolve attacker-controlled xi:include references to disclose local files or, through http references, reach internal network endpoints by server-side request forgery. Exploitation requires use of one of those factory/hardening APIs, the stock JDK provider with Apache Xerces absent from the classpath, explicit setXIncludeAware(true) or the equivalent reader feature, and XML from an untrusted source. The Xerces provider selected when Xerces is present and the Android provider are unaffected. This issue is fixed in version 0.1.2.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

copernik-eu · copernik-xml-factory