Sparx Systems Enterprise Architect version 17.1 is affected by an XML External Entity (XXE) injection vulnerability in its XSLT Debugger feature. This flaw allows processing of external entities from crafted XML files containing a DOCTYPE with external DTD references, enabling an attacker to read arbitrary files on the victim's filesystem. The vulnerability has a high severity with a CVSS 4.0 score of 8.2. Attempts to contact the vendor for remediation information were unsuccessful, and no patch information is currently available.
Adobe ColdFusion 2025 contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CVE-2026-106616) that allows an attacker to read arbitrary files on the system. This vulnerability can be exploited remotely without user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.6. Exploitation changes the security scope and could lead to disclosure of sensitive information. No official patch or remediation details are provided in the available data.
Adobe Experience Manager as a Cloud Service contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) that allows a low-privileged attacker to escalate privileges and gain elevated access to internal resources without user interaction. The vulnerability affects multiple versions up to 2026.9.28187 and 6.5.25. The issue changes the security scope and has a critical severity rating with a CVSS score of 9.6.
CVE-2026-77090 is a high-severity vulnerability in Commvault Cloud's CVFS component involving improper restriction of XML External Entity (XXE) references. This flaw can lead to information disclosure. Multiple versions of Commvault Cloud CVFS prior to specific maintenance releases are affected. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
CVE-2026-85970 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.x before 11.3.7 and 12.x before 12.1.0 enable XML external entity (XXE) processing by default in multiple server paths. This improper restriction of XML external entity references could allow an attacker to craft XML input that triggers server-side requests or discloses local files. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant confidentiality impact without integrity or availability compromise. No known exploits are reported in the wild, and the product is not a cloud service. Patch status is not explicitly confirmed in the provided data.
Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 have an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references in the SAML parser configuration. This flaw allows processing of external DTDs or entities, potentially leading to unintended network access or information disclosure. The vulnerability has a high severity with a CVSS score of 7.5. No known exploits are reported in the wild. The issue is fixed starting from version 11.3.7.
CVE-2026-92877 is a high-severity vulnerability in the Eclipse Foundation's jaxb-ri (core) component. It involves XML External Entity (XXE) injection due to reliance solely on the FEATURE_SECURE_PROCESSING flag to prevent external entity resolution. On some JAXP implementations where this feature does not fully block external entity resolution, attackers can exploit untrusted XML unmarshalling to read local files via out-of-band XXE.
IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 are vulnerable to an XML External Entity (XXE) injection vulnerability. This vulnerability allows a remote attacker to exploit improper restriction of XML external entity references when processing XML data. Successful exploitation could lead to exposure of sensitive information or memory resource consumption. The vulnerability has a high severity with a CVSS score of 8.2. No patch or remediation information is provided in the available data.
CVE-2026-102155 is an XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application component of Arista Networks CloudVision CUE. It allows any authenticated user to send crafted XML requests that can disclose arbitrary local files and cause partial denial of service. The vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. It has a high severity with a CVSS score of 8.5. No patch or remediation details are provided, and no known exploits are reported in the wild.
Newell Brands DYMO ID versions from 1.5.1.71 up to but not including 1.6.0 contain an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references. The application parses job files using XmlDocument.Load() without disabling DTD processing, which allows crafted files on browsed network shares to trigger server-side request forgery (SSRF), capture NTLMv2 credentials, read local files, or cause application crashes. This vulnerability is fixed in version 1.6.0.
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document.
The extension supplies its own Xalan-backed TransformerFactory to the xslt component and registers it as the JAXP default. Xalan-J 2.7.x predates JAXP 1.5 and does not honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET, so the external access restrictions Apache Camel applies to the TransformerFactory it creates were not in effect. On the xslt component path this affects message bodies that reach the transformer already as a javax.xml.transform.Source; bodies of other types are converted to a SAXSource by Apache Camel with external entities and external DTD loading disabled, and are not affected. Because the factory is also the JAXP default, other code in the application obtaining one through TransformerFactory.newInstance() loses the same restrictions without error.
Applications are affected if they use any of camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity, each of which brings the XSLT support extension onto the classpath. For all but camel-quarkus-xslt, the exposure is limited to the JAXP default factory, since those extensions do not perform XSLT transformations themselves.
Users are recommended to upgrade to version 3.33.3 or 3.40.0, which fixes this issue.
CVE-2026-102127 is a high-severity vulnerability in Kiteworks Email Protection Gateway involving improper restriction of XML external entity references. When an optional, non-default message-processing feature is enabled, a remote unauthenticated attacker can send a crafted message that exploits the XML parser to read files accessible to the gateway service account, including sensitive cryptographic keys and credentials. This could lead to unauthorized disclosure of critical information.
Apache Roller 6.1.5 contains an XML External Entity (XXE) vulnerability that allows users with entry-editing rights to cause the server to parse attacker-controlled XML data without disabling external entity resolution. This can lead to disclosure of files readable by the Roller process. The vulnerable feature involves the Trackback response parser, which is hidden in the UI but accessible directly. Upgrading to Apache Roller 6.1.6 or later removes the vulnerable parser and mitigates the issue.
CVE-2026-82386 is a high-severity vulnerability in Apache Roller 6.1.5 involving improper restriction of XML External Entity (XXE) references. It allows a weblog administrator to read files accessible to the Roller process and access internal network addresses by importing a crafted OPML document. This occurs because the bookmark import parser does not disable external entity resolution. No special configuration is needed to exploit this; the vulnerability is triggered via the administrator bookmark-import action. Upgrading to Apache Roller 6.1.6 or later mitigates this issue by using a hardened parser that disables external entities and document type declarations.
IBM Financial Transaction Manager (FTM) for Redhat OpenShift versions 4.0.6.0 through 4.0.10.0 contain an XML external entity (XXE) injection vulnerability. This flaw allows a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-611 and has a CVSS v3.1 base score of 6.5, indicating medium severity.
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.