xxe Archives • Daily CyberSecurity

Apache Camel Fixes Eight Flaws, Including High-Severity XXE in camel-saxon

Apache Camel vulnerabilities including XXE flaw CVE-2026-90885 fixed in Camel 4.23.0

Apache Camel Fixes Eight Flaws, Including High-Severity XXE in camel-saxon

Do Son October 26, 2026

Apache Camel fixes eight Apache Camel vulnerabilities, including XXE flaw CVE-2026-90885 and S3 injection CVE-2026-95664. Upgrade to 4.23.0.

CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.0 Cisco Crosswork SQL injection vulnerability CVE-2026-20030 CVSS 10.0 and BroadWorks XXE CVE-2026-20320 advisory

Cisco Crosswork SQL injection vulnerability CVE-2026-20030 CVSS 10.0 and BroadWorks XXE CVE-2026-20320 advisory

CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.0

Do Son August 20, 2026

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

Apache Lucene.NET Vulnerability Trio Fixed in Beta 18

Apache Lucene.NET vulnerability advisory showing a Lucene.Net.Replicator path traversal risk

Apache Lucene.NET Vulnerability Trio Fixed in Beta 18

Do Son July 9, 2026

Three Apache Lucene.NET vulnerability fixes land, including a Lucene.Net.Replicator path traversal flaw enabling unauthenticated file read. Patch now.

Apache CXF Framework Patches Three Severe Security Flaws Apache CXF vulnerabilities, JNDI injection flaws, CVE-2026-50634, CVE-2026-50633, CVE-2026-50628 Apache CXF vulnerabilities

Apache CXF vulnerabilities, JNDI injection flaws, CVE-2026-50634, CVE-2026-50633, CVE-2026-50628 Apache CXF vulnerabilities

Apache CXF Framework Patches Three Severe Security Flaws

Do Son May 26, 2026

Discover the latest critical Apache CXF vulnerabilities, including RCE and XXE flaws, and learn how to secure your open source services framework.

Triple Threat Patched: Zimbra 10.1.16 Fixes XSS, XXE & LDAP Injection

Do Son February 13, 2026

Zimbra 10.1.16 patches critical XSS, XXE, and LDAP injection flaws. Update immediately to secure your email collaboration suite and restore PDF previews.

Identity at Risk: Apache Syncope Patches Critical Login XSS & XXE Flaws

Do Son February 3, 2026

Apache patches XSS (CVE-2026-23794) & XXE flaws in Syncope. Vulnerability allows session hijacking via login page. Update to v3.0.16 or v4.0.4 now.

Apache SIS Patch Blocks XML Attack That Leaks Server Files Apache SIS, CVE-2025-68280

Apache SIS Patch Blocks XML Attack That Leaks Server Files

Do Son January 6, 2026

Apache SIS patches a decade-old XXE flaw (CVE-2025-68280) that allows attackers to steal server files via malicious map data. Update to version 1.6!

CISA KEV Alert: GeoServer XXE Flaw Under Active Attack Risks Data Theft & Internal Network Scanning CISA active exploit catalog known exploited vulnerabilities ActiveMQ RCE CVE-2026-34197 CISA KEV Catalog Actively Exploited Vulnerabilities CISA KEV Catalog CVE-2025-37164 GeoServer XXE, CISA KEV FortiWeb SQLi, CISA KEV Critical Vulnerabilities CVE-2024-20953

CISA active exploit catalog known exploited vulnerabilities ActiveMQ RCE CVE-2026-34197 CISA KEV Catalog Actively Exploited Vulnerabilities CISA KEV Catalog CVE-2025-37164 GeoServer XXE, CISA KEV FortiWeb SQLi, CISA KEV Critical Vulnerabilities CVE-2024-20953

CISA KEV Alert: GeoServer XXE Flaw Under Active Attack Risks Data Theft & Internal Network Scanning

Do Son December 12, 2025

CISA added a critical XXE flaw (CVE-2025-58360) in OSGeo GeoServer to the KEV Catalog. The actively exploited bug allows attackers to read arbitrary files and perform SSRF on internal networks. Patch immediately.

High-Severity GeoServer Flaw (CVE-2025-58360) Allows Unauthenticated XXE for File Theft and SSRF CVE-2023-25157 GeoServer XXE, Unauthenticated File Exfiltration

CVE-2023-25157 GeoServer XXE, Unauthenticated File Exfiltration

High-Severity GeoServer Flaw (CVE-2025-58360) Allows Unauthenticated XXE for File Theft and SSRF

Do Son December 1, 2025

GeoServer patched a High-severity XXE flaw (CVE-2025-58360, CVSS 8.2) in its WMS GetMap operation. The flaw allows unauthenticated remote attackers to read arbitrary files and perform SSRF. Update to v2.27.0.

CVE-2025-54988: Critical XXE Vulnerability in Apache Tika PDF Parser Exposes Sensitive Data Apache Tika XXE, Malicious PDF Exploit Apache Tika, XXE vulnerability CVE-2025-54988

CVE-2025-54988: Critical XXE Vulnerability in Apache Tika PDF Parser Exposes Sensitive Data

Do Son August 21, 2025

A critical XXE flaw in Apache Tika's PDF parser could allow attackers to access sensitive data and pivot into internal networks via crafted PDF files.

Adobe AEM Forms Patch: Critical Flaws (CVE-2025-54253, CVSS 10.0) Allow RCE & Arbitrary File Read, Public PoCs Available

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

Adobe AEM Forms Patch: Critical Flaws (CVE-2025-54253, CVSS 10.0) Allow RCE & Arbitrary File Read, Public PoCs Available

Do Son August 6, 2025

Adobe released urgent patches for two critical flaws (CVE-2025-54253, -54254) in AEM Forms on JEE, allowing unauthenticated RCE & file reads, with public PoCs available.

Critical Apache Jackrabbit Flaw (CVE-2025-53689): XXE Attacks Allow Data Exfiltration & DoS Apache Jackrabbit, JNDI injection CVE-2023-37895 Apache Jackrabbit, XXE Vulnerability

Critical Apache Jackrabbit Flaw (CVE-2025-53689): XXE Attacks Allow Data Exfiltration & DoS

Do Son July 14, 2025

A critical XXE flaw (CVE-2025-53689) in Apache Jackrabbit allows blind XXE attacks for data exfiltration, DoS, or internal file exposure. Update to patched versions immediately!

Critical Vulnerabilities Found in Schneider Electric’s EcoStruxure IT Data Center Expert CVE-2024-8884 & CVE-2024-11737 Schneider Electric, Critical Vulnerabilities

CVE-2024-8884 & CVE-2024-11737 Schneider Electric, Critical Vulnerabilities

Critical Vulnerabilities Found in Schneider Electric’s EcoStruxure IT Data Center Expert

Do Son July 10, 2025

Schneider Electric warns of critical flaws (CVSS 10.0 RCE, SSRF, EoP) in EcoStruxure IT Data Center Expert. Patch to v9.0 immediately to prevent data center disruption.

IBM QRadar SIEM Exposed by Trio of Security Flaws, Including Critical Command Execution Bug IBM QRadar, Critical Vulnerabilities

IBM QRadar SIEM Exposed by Trio of Security Flaws, Including Critical Command Execution Bug

Do Son June 21, 2025

IBM warns of three critical QRadar SIEM flaws (CVSS 9.1 RCE, XXE, info disclosure). Update to 7.5.0 UP12 IF02 immediately to protect your SIEM.

CVSS 9.9: Critical XXE Flaw in GeoTools Exposes Geospatial Data Systems XXE Vulnerability

CVSS 9.9: Critical XXE Flaw in GeoTools Exposes Geospatial Data Systems

Do Son June 10, 2025

A critical XXE vulnerability (CVSS 9.9) in GeoTools llows data disclosure and RCE. Update immediately to patched versions!

9.8 CVSS Score: Rockwell Automation Impacted by High-Severity log4net Vulnerability CVE-2024-5988 and CVE-2024-5989 Rockwell Automation vulnerability CVE-2018-1285

CVE-2024-5988 and CVE-2024-5989 Rockwell Automation vulnerability CVE-2018-1285

9.8 CVSS Score: Rockwell Automation Impacted by High-Severity log4net Vulnerability

Do Son May 17, 2025

Critical vulnerability (CVSS 9.8) in Rockwell Automation! Learn about the high-risk flaw and how to protect industrial systems.

CVE-2024-55875 (CVSS 9.8): Critical XXE Vulnerability Found in http4k Toolkit

Do Son December 16, 2024

Understanding the CVE-2024-55875 vulnerability in the http4k toolkit: risks, impacts, and ways to mitigate this critical XXE Injection vulnerability.