Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49875 |
critical | 9.8 | 0.0052 | 2026-06-12 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory w | |
CVE-2026-10025 |
critical | 9.8 | 0.0065 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML Externa | |
CVE-2026-90531 |
critical | 9.6 | 0.0140 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('X | |
CVE-2026-16626 |
critical | 9.3 | 0.0045 | 2026-08-10 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft | |
CVE-2026-13449 |
critical | 9.1 | 0.0041 | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e | |
CVE-2026-108357 |
high | 8.8 | 0.0036 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.1 | |
CVE-2026-108358 |
high | 8.8 | 0.0048 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1 | |
CVE-2026-55471 |
high | 8.7 | 0.0057 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J | |
CVE-2026-54078 |
high | 8.7 | 0.0056 | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1. | |
CVE-2026-54079 |
high | 8.7 | 0.0056 | 2026-07-29 | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. Fro | |
CVE-2026-15803 |
high | 8.7 | 0.0047 | 2026-08-12 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) pr | |
CVE-2026-113582 |
high | 8.7 | 0.0046 | 2026-10-22 | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera al | |
CVE-2026-54668 |
high | 8.7 | 0.0030 | 2026-10-23 | Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digi | 1 PoC |
CVE-2026-41936 |
high | 8.6 | 0.0034 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the ad | |
CVE-2025-11700 |
high | 8.4 | 0.3168 | 2025-11-12 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to in | |
CVE-2026-112198 |
high | 8.3 | 0.0016 | 2026-10-28 | XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop | |
CVE-2026-41895 |
high | 8.2 | 0.0027 | 2026-05-12 | changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpat | |
CVE-2026-93570 |
high | 8.2 | — | 2026-10-29 | Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user si | |
CVE-2023-42346 |
high | 7.5 | 0.0023 | 2026-05-08 | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. | |
CVE-2026-17615 |
high | 7.5 | 0.0082 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker | |
CVE-2026-118039 |
high | 7.5 | 0.0027 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external en | |
CVE-2026-8396 |
high | 7.5 | 0.0044 | 2026-07-17 | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS a | |
CVE-2026-65432 |
high | 7.5 | 0.0065 | 2026-08-06 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and e | |
CVE-2026-90885 |
high | 7.5 | 0.0060 | 2026-10-26 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. | |
CVE-2023-42344 |
high | 7.3 | 0.0234 | 2026-05-08 | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive informatio | |
CVE-2026-66090 |
high | 7.1 | 0.0027 | 2026-10-29 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity | |
CVE-2026-42212 |
high | 7.1 | 0.0040 | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCA | |
CVE-2026-56701 |
high | 7.1 | 0.0031 | 2026-06-23 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload | |
CVE-2026-44018 |
high | 7.1 | 0.0016 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with th | |
CVE-2026-70448 |
high | 7.1 | 0.0032 | 2026-08-05 | Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external | |
CVE-2026-6653 |
high | 7.0 | 0.0036 | 2026-06-22 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allow | |
CVE-2026-48981 |
medium | 6.7 | 0.0015 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior | |
CVE-2026-33737 |
medium | 6.5 | 0.0022 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use sim | |
CVE-2026-54082 |
medium | 6.5 | 0.0040 | 2026-07-29 | veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1. | |
CVE-2026-58248 |
medium | 6.5 | 0.0044 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attack | |
CVE-2026-4980 |
medium | 6.3 | 0.0024 | 2026-03-27 | A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1. | |
CVE-2026-16999 |
medium | 6.3 | 0.0017 | 2026-08-12 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Docu | |
CVE-2026-66089 |
medium | 6.1 | 0.0027 | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a pars | |
CVE-2026-46722 |
medium | 5.9 | 0.0030 | 2026-05-19 | The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or | |
CVE-2026-6807 |
medium | 5.5 | 0.0020 | 2026-04-28 | A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of X | |
CVE-2026-75055 |
medium | 5.5 | 0.0015 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE | |
CVE-2026-75058 |
medium | 5.5 | 0.0015 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers | |
CVE-2026-6501 |
medium | 5.3 | 0.0023 | 2026-05-04 | Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocumen | |
CVE-2026-44445 |
medium | 5.3 | 0.0022 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.12.0, | |
CVE-2026-54470 |
medium | 5.3 | 0.0030 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML | |
CVE-2024-58335 |
medium | 5.0 | 0.0020 | 2025-12-24 | OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype | |
CVE-2026-20029 |
medium | 4.9 | 0.0608 | 2026-01-07 | A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE | |
CVE-2026-57917 |
medium | 4.8 | 0.0018 | 2026-07-27 | proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SS | |
CVE-2026-14304 |
medium | 4.6 | 0.0023 | 2026-08-05 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions | |
CVE-2026-47898 |
medium | 4.0 | 0.0047 | 2026-07-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net |