Overview 40 matches · 5 in Waratek scope · 5 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
40matches
5in Waratek scope12.5%
5protected12.5%
0exploited0.0%
0CISA KEV0.0%
1public PoC2.5%
0EPSS ≥ 0.50.0%
Protected by Waratek
5
12.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
3
7.5%
Not applicable
32
80.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
5
12.5%
partly blocked
0
0.0%
not blocked
35
87.5%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
3
7.5%
Forecast only
0
0.0%
No public exploit
37
92.5%
split by
peak 10 / year
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20040
20050
20060
20070
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20090
20100
20110
20120
20130
20141
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20150
20160
20171
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20180
20192
Outside Waratek scope2
Medium2
not blocked2
No public exploit2
20203
Protected by Waratek1
Not applicable2
Medium3
blocked by ARMR today1
not blocked2
No public exploit3
20215
Not applicable5
Medium5
not blocked5
No public exploit5
20224
Outside Waratek scope1
Not applicable3
Medium4
not blocked4
No public exploit4
20233
Not applicable3
Medium3
not blocked3
Proof of concept only2
No public exploit1
20246
Not applicable6
Medium6
not blocked6
Proof of concept only1
No public exploit5
20253
Not applicable3
Medium3
not blocked3
No public exploit3
202610
Protected by Waratek2
Not applicable8
Medium10
blocked by ARMR today2
not blocked8
No public exploit10
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-111252 | Medium | 2026-10-15 | Protected by Waratek | No public exploit | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition URL that the server fetches and parses. Both deeply nested entities and a single large entity referenced many times cause the memory exhaustion. The fix caps the number of entity expansions for all XML parsing and rejects any DOCTYPE in requisition and foreign-source XML. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. |
| CVE-2026-74030 | Medium | 2026-10-13 | Not applicable | No public exploit | Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group. |
| CVE-2026-92001 | Medium | 2026-09-23 | Not applicable | No public exploit | Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. |
| CVE-2023-46035 | Medium | 2026-09-14 | Not applicable | No public exploit | The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. |
| CVE-2026-16180 | Medium | 2026-09-04 | Not applicable | No public exploit | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities. |
| CVE-2026-14865 | Medium | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. |
| CVE-2026-12993 | Medium | 2026-06-26 | Protected by Waratek | No public exploit | A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit. |
| CVE-2026-23822 | Medium | 2026-05-12 | Not applicable | No public exploit | A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x |
| CVE-2026-40260 | Medium | 2026-04-17 | Not applicable | No public exploit | pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0. |
| CVE-2026-27807 | Medium | 2026-03-06 | Not applicable | No public exploit | MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4. |
| CVE-2025-20369 | Medium | 2025-10-01 | Not applicable | No public exploit | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks. |
| CVE-2025-5466 | Medium | 2025-08-12 | Not applicable | No public exploit | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service |
| CVE-2025-0617 | Medium | 2025-01-29 | Not applicable | No public exploit | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger file parsing containing exponential entity expansions in the consumer process thus causing a Denial of Service. |
| CVE-2024-43398 | Medium | 2024-08-22 | Not applicable | No public exploit | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability. |
| CVE-2024-27142 | Medium | 2024-06-14 | Not applicable | No public exploit | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL. |
| CVE-2024-27141 | Medium | 2024-06-14 | Not applicable | No public exploit | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL. |
| CVE-2022-28652 | Medium | 2024-06-04 | Not applicable | No public exploit | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
| CVE-2024-1455 | Medium | 2024-03-26 | Not applicable | Proof of concept only | A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading to a denial of service (DoS). |
| CVE-2023-52426 | Medium | 2024-02-04 | Not applicable | No public exploit | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. |
| CVE-2023-41635 | Medium | 2023-08-31 | Not applicable | Proof of concept only | A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file. |
| CVE-2023-3569 | Medium | 2023-08-08 | Not applicable | No public exploit | In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service. |
| CVE-2023-20052 | Medium | 2023-03-01 | Not applicable | Proof of concept only | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. |
| CVE-2022-44641 | Medium | 2022-11-18 | Not applicable | No public exploit | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service. |
| CVE-2022-34467 | Medium | 2022-07-12 | Not applicable | No public exploit | A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component. |
| CVE-2021-41559 | Medium | 2022-06-28 | Not applicable | No public exploit | Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document. |
| CVE-2021-20464 | Medium | 2022-04-22 | Outside Waratek scope | No public exploit | IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813. |
| CVE-2021-31842 | Medium | 2021-09-17 | Not applicable | No public exploit | XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process. |
| CVE-2021-3541 | Medium | 2021-07-09 | Not applicable | No public exploit | A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. |
| CVE-2020-15303 | Medium | 2021-06-28 | Not applicable | No public exploit | Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. |
| CVE-2020-24665 | Medium | 2021-01-29 | Not applicable | No public exploit | The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA |
| CVE-2021-1267 | Medium | 2021-01-13 | Not applicable | No public exploit | A vulnerability in the dashboard widget of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by crafting an XML-based widget on an affected server. A successful exploit could cause increased memory and CPU utilization, which could result in a DoS condition. |
| CVE-2012-3340 | Medium | 2020-09-01 | Not applicable | No public exploit | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 78291. |
| CVE-2020-2172 | Medium | 2020-04-07 | Protected by Waratek | No public exploit | Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2020-6856 | Medium | 2020-02-06 | Not applicable | No public exploit | An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders. |
| CVE-2013-6461 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
| CVE-2013-6460 | Medium | 2019-11-05 | Outside Waratek scope | No public exploit | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
| CVE-2017-5644 | Medium | 2017-03-24 | Protected by Waratek | No public exploit | Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. |
| CVE-2014-1868 | Medium | 2014-10-06 | Protected by Waratek | No public exploit | Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack. |
| CVE-2008-3281 | Medium | 2008-08-27 | Not applicable | No public exploit | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. |
| CVE-2003-1564 | Medium | 2003-12-31 | Not applicable | No public exploit | libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack." |