https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:19:47.054818+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2019-04862 bdu:2019-04862 2026-10-03T02:19:47.132810+00:00 bdu:2019-04862 https://cve.radiocsirt.org/vuln/cnvd-2019-02944 cnvd-2019-02944 2026-10-03T02:19:47.132867+00:00 cnvd-2019-02944 https://cve.radiocsirt.org/vuln/euvd-2026-65486 EUVD-2026-65486 2026-10-03T02:19:47.132896+00:00 EUVD-2026-65486 https://cve.radiocsirt.org/vuln/fkie_cve-2018-11788 fkie_cve-2018-11788 2026-10-03T02:19:47.132908+00:00

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

 https://cve.radiocsirt.org/vuln/ghsa-92wj-x78c-m4fx GHSA-92wj-x78c-m4fx — XML External Entity Reference in Apache Karaf 2026-10-03T02:19:47.132938+00:00

Affected: Maven: org.apache.karaf.specs:org.apache.karaf.specs.java.xml

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.

 https://cve.radiocsirt.org/vuln/gsd-2018-11788 gsd-2018-11788 2026-10-03T02:19:47.132965+00:00 gsd-2018-11788