Dashboard / CVE-2026-47898

CVE-2026-47898

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 28/100
Published: 2026-07-03 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: High
PR: High
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Weakness Classification (1)

Affected Software (13)

VendorProductVersion
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0
apache lucene.net 4.8.0

References & Advisories (2)

Bug Bounty Relevance

28 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

4.0 / 10.0 v4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.47%
Raw Score 0.004680
Percentile 40.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00468
2026-10-28
0.00468

Intelligence Sources

nvd ref →

External Links