Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:49:39 +0000 CVE-2026-49875 — Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils https://vulnerability.circl.lu/vuln/cve-2026-49875 <p><strong>Affected:</strong> Apache Software Foundation Apache CXF, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5, Red Hat Single Sign-On 7</p> <p>Apache CXF&#39;s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache CXF, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5, Red Hat Single Sign-On 7</p> <p>Apache CXF&#39;s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-49875